Telekom Security: QCStatement with http link to PDS

Deutsche Telekom Security GmbH self-reported an incident involving two misissued test certificates where the QCStatement extension contained an http link instead of the required https link to the PKI Disclosure Statements (PDS). The error was identified during audit preparations, and both certificates were immediately revoked as they had never been used in production. The CA has updated its internal processes to include additional linting checks and contributed a pull request to the zlint tool to prevent similar issues in the future. The incident has been resolved with all action items completed.

1. 2025-02-13 First certificate of the type was issued on the new platform.
2. 2025-04-02 Error found and both certificates revoked.
3. 2025-04-30 All action items completed and incident reported closure requested.

1. 2025-04-02 Telekom representative — Preliminary Incident Report filed regarding the misissued certificates.
2. 2025-04-08 Telekom representative — Full Incident Report provided detailing the misissuance and corrective actions.
3. 2025-05-12 Telekom representative — Request for closure of the bug as all action items have been completed.