← Microsoft Corporation cases
Bugzilla #1962830
Ca Certificate Compliance
Microsoft PKI Services: Subscriber certificate change made that was not compliant with CPS
RESOLVED
FIXED
Microsoft Corporation
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Microsoft PKI Services disclosed a compliance failure involving the issuance of Subscriber certificates that did not include the required OCSP URI, as mandated by their active Certificate Policy Statement (CPS) version 3.2.4. This issue arose from a configuration change made during internal testing after OCSP became optional in the industry. The non-compliance was identified on April 25, 2025, and all impacted certificates were revoked the same day. The CA has since updated its change management processes to ensure CPS compliance is reviewed before any changes are implemented. A full incident report has been completed, and all action items have been addressed.
Chronology
- First certificate issued without OCSP that conflicted with the CPS language.
- New CPS version published allowing OCSP to be optional.
- Non-compliance identified and all impacted certificates revoked.
Thread Activity
- Disabled representative — Preliminary incident report submitted detailing the compliance failure.
- Disabled representative — Draft incident report shared with additional details.
- Microsoft Corporation — Closure report submitted detailing remediation steps taken.
Participants
Disabled representative
Microsoft Corporation
External References
Related Bugzilla IDs Mentioned
Similar Local Cases
Microsoft PKI Services: Pre-Sign Linting Validation did not occur in ICA creation
Microsoft PKI Services: Failure to update action item status within 3 days
Microsoft PKI Services: Incorrect Revocation Reason Code
Microsoft PKI Services: Improper Disclosure of CRLs – Does Not Match CA Subject
Microsoft PKI Services: Policy document bug
Microsoft PKI Services: Improper Disclosure of CRLs – Protocol Scheme
Microsoft PKI Services: Improper Disclosure of CRLs – IDP – New CAs
Microsoft PKI Services: Null Character Bug and Microsoft Root CAs