← Microsec Ltd. cases
Bugzilla #1952519
Self Reported Incident
Repository Issue
Microsec: Inconsistent Disclosure of S/MIME BR Audit Information in CCADB
RESOLVED
FIXED
Microsec Ltd.
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Microsec Ltd. reported an issue regarding the inconsistent disclosure of S/MIME BR audit information in the Common CA Database (CCADB). The problem was identified when a doppelganger root certificate record did not specify any S/MIME BR audit details, which is required by Mozilla, Apple, and Microsoft policies. The issue was triggered by an email from Rob Stradling highlighting the problem. Microsec conducted an investigation and proposed the removal of the duplicate root certificate from CCADB. After discussions with CCADB support, the issue was resolved by updating the CCADB record with the necessary audit information. The bug was subsequently closed as invalid.
Chronology
- Rob Stradling reported the issue to the CCADB public mailing list.
- Microsec submitted the updated CCADB record to the Root Store.
- The bug was closed as invalid after the CCADB record was updated.
Thread Activity
- Microsec representative — Microsec opened the incident bug in Bugzilla.
- Microsec representative — CCADB Support responded and planned to discuss the issue.
- Mozilla representative — The case has been processed in CCADB.
- Microsec representative — Microsec confirmed no audit report issue for their certificates.
- CCADB representative — Final call for comments on the incident report.
Participants
Microsec representative
Stradling representative
Mozilla representative
Community commenter
CCADB representative
External References
Similar Local Cases
Microsec: Issuance of 2 IVCP precertificates without givenName, surName, localityName fields
Microsec: Expired Certificates on test Pages for Revocation
Microsec: Findings in 2023 Audit
Microsec: CT Logging mistakes
Microsec: "DV valid" test website certificate issued under incorrect root
Camerfirma: Outdated audit statements for intermediate certs
Firmaprofesional: Incorrect publication of information for "Test Website - Revoked" URL in the CCADB.
GoDaddy: cross certificate disclosure to CCADB