← Microsoft Corporation cases
Bugzilla #1974592
Ca Certificate Compliance
Microsoft PKI Services: Pre-Sign Linting Validation did not occur in ICA creation
RESOLVED
FIXED
Microsoft Corporation
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Microsoft PKI Services identified an internal compliance failure where five new intermediate certificate authorities (ICAs) were issued without the required pre-sign linting validation, violating CA/Browser Forum Baseline Requirements. This issue was discovered during a post-issuance review on June 26, 2025. The impacted ICAs were revoked on July 1, 2025, and no subscriber certificates were issued from them. Microsoft has implemented corrective actions, including updates to their configuration management tools and improvements in UI visibility for critical settings. All action items related to this incident have been completed, and a closure report has been submitted.
Chronology
- Non-compliance identified during post-issuance review.
- Revocation of the five impacted ICAs.
- Closure report submitted.
Thread Activity
- Microsoft Corporation — Opened Bugzilla bug with preliminary report.
- Microsoft Corporation — Submitted full incident report detailing the compliance failure.
- Microsoft Corporation — Provided report closure summary and confirmed completion of all action items.
- Microsoft Corporation — Requested closure of the bug as all action items were completed.
Participants
Microsoft Corporation
External References
Similar Local Cases
Microsoft PKI Services: Subscriber certificate change made that was not compliant with CPS
Microsoft PKI Services: Failure to update action item status within 3 days
Microsoft PKI Services: Incorrect Revocation Reason Code
Microsoft PKI Services: Improper Disclosure of CRLs – Does Not Match CA Subject
Microsoft PKI Services: Improper Disclosure of CRLs – IDP – New CAs
Microsoft PKI Services: Improper Disclosure of CRLs – Protocol Scheme
Microsoft PKI Services: Malformed ICAs (Key Usage Malformed)
Microsoft PKI Services: Null Character Bug and Microsoft Root CAs