← Chunghwa Telecom cases
Bugzilla #1956910
Certificate Misissuance
Chunghwa Telecom: OV TLS Server certificate issuance by GTLSCA without proper validation
RESOLVED
FIXED
Chunghwa Telecom
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Chunghwa Telecom reported a compliance issue involving the issuance of 22 OV TLS certificates by GTLSCA without proper validation of CAA records. The problem was identified during an internal investigation initiated after a third-party report suggested possible mis-issuance. Upon review, it was found that the certificates were issued despite non-compliance with TLS BR requirements. All affected certificates were revoked on March 27, 2025, and the CA has since implemented corrective measures, including retraining personnel and automating CAA checks to prevent future occurrences. The incident has been resolved and the CA is currently undergoing restructuring.
Chronology
- Revocation of 22 affected certificates completed.
Thread Activity
- Cht representative — Preliminary incident report submitted detailing the compliance failure.
- Cht representative — Full incident report created outlining the investigation and findings.
- Cht representative — Report closure summary provided, detailing remediation actions taken.
Participants
Cht representative
CCADB representative
Community commenter
External References
Similar Local Cases
Chunghwa Telecom: Failure to check restrictive CAA record during Migration
Chunghwa Telecom: Issuance of certificate using keys previously reported as compromised
Chunghwa Telecom: Wrong Extended Key Usage setting by GTLSCA
Chunghwa Telecom: Test certificate with unregistered domain name
TrustAsia: ACME Authorization Reuse Non-Compliance
SSL.com: DCV bypass and issue fake certificates for any MX hostname
Certigna: Multiple Reserved Certificate Policy Identifiers in CA certificates
TunTrust: SSL OV mis-issuance against CP/CPS (Email attribute)