Financijska agencija (Fina): Mis-issued certificates

Financijska agencija (Fina) issued certificates for two well-known IP addresses and for non-existent domains, which were intended solely for internal testing. The incident was reported by Microsoft’s Trusted Root Program, prompting an investigation that revealed the certificates were issued without proper verification. All affected certificates were revoked, and the private keys were destroyed. Fina has since implemented corrective measures, including revising their procedures for issuing test certificates and enhancing staff training to prevent future occurrences.

1. 2025-09-04 Initial report of mis-issued certificates received from Microsoft.
2. 2025-09-04 Affected certificates revoked and private keys destroyed.
3. 2025-09-18 Full incident report submitted.
4. 2026-01-12 Stage 2 of eIDAS conformity assessment audit began.
5. 2026-02-10 Conformity Assessment Report received.
6. 2026-03-28 Closure report submitted.