Microsoft PKI Services CPS policy document error on keyEncipherment

This case concerns a Microsoft PKI Services incident report about a CPS documentation error affecting its public TLS policy documents. Microsoft said CPS version 3.2.4 incorrectly stated that keyEncipherment was not present in subscriber certificates with RSA public keys, even though Microsoft had always included it, and later CPS 3.3.0 said keyEncipherment may be set without distinguishing RSA from ECC. Microsoft stated that the issue was identified on 2025-04-25 after a third-party researcher submitted a Certificate Problem Report directly to Microsoft. In the bug, Microsoft described the problem as a policy document management error and published incident reports, root cause information, and action items to improve document review, version control, and alignment between CPS content and linting. The thread also records that revocation questions arising from this incident were split into separate Bug 1965612, which Microsoft opened to track failure to revoke within five days. Microsoft later published CPS v3.3.2 and marked several remediation items complete, including clarifying RSA versus ECC keyEncipherment language and formalizing review of external Bugzilla incidents. The bug remained open with ongoing status updates about remaining action items, and the Bugzilla status shown is RESOLVED FIXED.

1. 2024-07-01 Microsoft published Public TLS CPS 3.2.4 with a typo stating keyEncipherment was not present in subscriber certificates with RSA public keys.
2. 2025-04-21 Microsoft published Public TLS CPS 3.3.0, replacing tables with Appendix B language stating keyEncipherment may be set but not distinguishing RSA from ECC.
3. 2025-04-25 A third-party researcher sent a Certificate Problem Report to Microsoft identifying mismatches between subscriber certificates and CPS language.
4. 2025-04-29 Microsoft published Public TLS CPS 3.3.1 retaining language that keyEncipherment may be set without distinguishing RSA from ECC.
5. 2025-05-08 Microsoft opened Bug 1965612 to track failure to revoke impacted certificates within five days.
6. 2025-07-03 Microsoft published CPS v3.3.2 and reported completion of related CPS clarification action items.

1. 2025-04-26 Disabled representative — Microsoft opened the bug with a preliminary incident report describing a CPS typo and stating the source was a third-party Certificate Problem Report.
2. 2025-05-03 Disabled representative — Microsoft posted a draft incident report with timeline details and said analysis and root cause work were still in progress.
3. 2025-05-07 Internet Security Research Group — Aaron Gable asked whether Microsoft planned to revoke all affected RSA subscriber certificates issued while the CPS was incorrect.
4. 2025-05-08 Disabled representative — Microsoft said it was still working on a response and would reply the next day.
5. 2025-05-10 Disabled representative — Microsoft said it had opened Bug 1965612 to address failure to revoke within five days and would provide revocation details there.
6. 2025-05-10 Disabled representative — Microsoft posted its full incident report, including affected certificate counts, related bugs, and initial root cause information.
7. 2025-05-10 Community commenter — Wayne asked Microsoft to answer the revocation question directly and to explain its document review and comparison process.
8. 2025-05-11 Disabled representative — Microsoft acknowledged the BR revocation requirement, said the five-day window had passed, and said it had not finalized a revocation plan.
9. 2025-05-13 Google representative — Chrome Root Program asked detailed questions about related incidents, revocation expectations, and whether Microsoft's action items would meaningfully reduce recurrence.
10. 2025-05-14 Microsoft Corporation — Microsoft responded that it had formal processes for its own bugs but only ad hoc review of other CAs' Bugzilla incidents, and said it would add a formal review process as a repair item.
11. 2025-05-14 DigiCert — DigiCert said Microsoft is accountable for its own CPS updates, audits, and operations, while DigiCert maintains contractual compliance expectations for the cross-sign.
12. 2025-05-16 Microsoft Corporation — Microsoft published action items including formalizing Bugzilla learnings, updating CP/CPS OID information, aligning linting with CP/CPS, and converting the CPS to Markdown.
13. 2025-05-20 Google representative — Chrome Root Program asked follow-up questions about Microsoft's historical Bugzilla review practices, evaluation criteria, and additional technical controls.
14. 2025-05-23 DigiCert — DigiCert described its oversight practices for externally operated cross-signed CAs, including regular meetings, audit review, and notice of policy changes.
15. 2025-05-23 Microsoft Corporation — Microsoft posted a weekly status update, added an action item to evaluate CPS-to-lint translation, and corrected the reported non-compliance start date to 2024-07-21.
16. 2025-05-23 Microsoft Corporation — Microsoft explained its prior ad hoc review of other CAs' Bugzilla incidents and said it would add review of new Bugzilla bugs to weekly compliance change control meetings.
17. 2025-06-06 Microsoft Corporation — Microsoft accidentally posted a closure summary for a different incident in this bug.
18. 2025-06-06 Community commenter — Wayne asked whether the closure summary had been intended for a different incident.
19. 2025-06-06 Microsoft Corporation — Microsoft confirmed the closure summary was posted in error and belonged in Bug 1962830.
20. 2025-06-13 Microsoft Corporation — Microsoft reported some action items complete, extended some CPS-related due dates, and said internal governance questions had delayed CPS publication.
21. 2025-07-03 Microsoft Corporation — Microsoft said its new CPS v3.3.2 had been published and marked several CPS-related action items done.
22. 2025-07-18 Microsoft Corporation — Microsoft said it had completed the action item to formalize Bugzilla bug learnings and requested less frequent update cadence.
23. 2025-12-05 Community commenter — Wayne asked Microsoft to explain why one remaining action item's due date had been moved back by two months.
24. 2026-03-27 Microsoft Corporation — Microsoft said it was still progressing through the last repair item with no major changes to report.