Microsoft PKI Services incident report: 784 TLS certificates issued without Basic Constraints required by CPS
Microsoft PKI Services reported a self-discovered compliance issue involving Public TLS end-entity certificates that were issued without the Basic Constraints extension required by its CPS. The issue was found through enhanced monitoring added as part of remediation work for Bug 1962829. Microsoft said 784 certificates were affected, that there were no security concerns with the issued certificates, and that all impacted certificates were revoked on 2025-07-25. The report also stated that issuance from the affected profiles was disabled while fixes were applied, and that Microsoft updated its CPS documentation and implemented additional validation and linting controls. Microsoft later posted a closure report stating that all identified action items were completed and requested closure of the bug.
- Microsoft discovered 784 Public TLS end-entity certificates issued without the Basic Constraints extension required by its CPS.
- All impacted certificates were revoked.
- Microsoft submitted a closure report stating that all identified action items were completed.
- Microsoft Corporation — Microsoft opened a preliminary incident report describing the Basic Constraints non-compliance and said the issue was found through enhanced monitoring tied to Bug 1962829.
- Microsoft Corporation — Microsoft posted the full incident report, including the affected certificate count, timeline, revocation completion, and initial remediation actions.
- Microsoft Corporation — Microsoft said action item #3, updating CPS documentation to clarify the Basic Constraints requirement, was complete.
- Microsoft Corporation — Microsoft said action item #1, establishing a mandatory validation checklist for issuance profiles, was complete.
- Microsoft Corporation — Microsoft said all action items associated with the bug were complete and that a closure report would be posted soon.
- Microsoft Corporation — Microsoft posted the closure report and requested closure of the bug.