← Telia Company cases
Bugzilla #1999296
Certificate Problem Report
Telia: Findings in 2025 ETSI Audit - Incident Report #1 – Vulnerability management
RESOLVED
FIXED
Telia Company
AI Summary
Telia Company reported a non-conformity regarding the timely remediation of critical vulnerabilities identified during a penetration test on October 13, 2025. The vulnerabilities, affecting the Apache HTTP server used for S/MIME certificate management, were not addressed within the required 48-hour timeframe as mandated by ETSI EN 319 401. The incident was disclosed following an audit session on November 5, 2025, and a full incident report was submitted by November 21, 2025. Telia has since implemented corrective actions, including updating their software management processes and conducting training for relevant personnel.
Chronology
- Vulnerability scan performed.
- Review of vulnerability scan report.
- Non-conformity start date.
- Auditor identifies findings.
- Non-compliance verified.
- Full incident report submitted.
Participants
Antti Backman
External References
Similar Local Cases
Telia: Inccorrect CRL URL on a Root CA record in CCADB
Telia: Delayed revocation of seven (7) certificates related to incident 1896108
Telia: TLS OV certificate with subject countryName and localityName mismatch
Telia: Two Intermediate CA certificates not listed in audit report
Telia: Disallowed curve (P-521) in leaf certificate
Telia: AIA CA Issuer field pointing to PEM encoded cert
Telia: Issued three precertificates with non-NIST EC curve
Telia: Certificates with RSA keys where modulus is not divisible by 8