← Chunghwa Telecom cases
Bugzilla #2005567
Ca Certificate Compliance
Chunghwa Telecom: CA Certificates Published in PEM format
RESOLVED
FIXED
Chunghwa Telecom
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Chunghwa Telecom reported an incident where a certificate file for its GTLSCA SubCA was served in PEM format instead of the required DER format as per RFC 5280. This issue was identified through a third-party report, and the CA took immediate action to correct the encoding format. A full investigation was conducted, and a detailed incident report was provided. The CA has since implemented several remediation measures, including automated checks for AIA link integrity and mandatory encoding verification in their publication workflow. The incident was resolved on December 10, 2025, and all action items have been completed.
Chronology
- Non-compliance identified and corrected
Thread Activity
- Cht representative — Preliminary incident report submitted detailing the PEM format issue.
- Cht representative — Full incident report provided with a timeline and impact analysis.
- Cht representative — Report closure summary submitted, confirming all action items are completed.
Participants
Cht representative
Community commenter
Apple representative
CCADB representative
External References
Related Bugzilla IDs Mentioned
Similar Local Cases
Certigna: AIA CA issuer field pointing to PEM encoded cert
Chunghwa Telecom: Wrong Extended Key Usage setting by GTLSCA
Chunghwa Telecom: Test certificate with unregistered domain name
Financijska agencija (Fina): Mis-issued certificates
Chunghwa Telecom: Findings in 2025 WebTrust Audit - GTLSCA Audit Incident Report #1 - mass certificate revocation plan
D-Trust: Missed Revocation of TLS certificates affected by Bugzilla 1884714
GoDaddy: Certificates with invalid embedded SCT signatures
Telekom Security: QCStatement with http link to PDS