Microsec: CT Logging mistakes

RESOLVED FIXED Microsec Ltd.

This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update. Always refer to the official Bugzilla thread as the authoritative source. If you spot an inaccuracy, let me know via the contact form.

AI Summary

Microsec Ltd. reported a compliance issue involving the issuance of 44 website authentication certificates with improper SCTs from CT log servers marked as 'Qualified' instead of 'Usable'. This misissuance was identified after a third-party report on December 12, 2025. The CA took immediate action by revoking the affected certificates within the required 5-day timeframe and implemented several corrective measures, including the introduction of automated monitoring for CT log lists and the use of verification tools to prevent future occurrences. The incident was resolved, and all action items have been completed, leading to the closure of the case.

Model: gpt-4o-mini Generated: 2026-06-13 21:16 UTC Revised: 2026-06-16 19:18 UTC Confidence: 0.90 16 comments

Chronology

2025-12-12 Third-party report identified CT logging mistakes.
2025-12-16 All affected certificates revoked.
2026-03-05 Incident report closure requested.

Thread Activity

2025-12-14 Microsec representative — Preliminary incident report submitted.
2026-01-15 Microsec representative — Status report indicating no recurrence of the error.
2026-03-05 Microsec representative — Report closure summary provided.

Participants

Microsec representative CCADB representative

External References

Original Bugzilla Case

Similar Local Cases

#2013576 RESOLVED Self Reported Incident Certificate Misissuance Opened 2026-01-30 · Closed 2026-02-27 · 100% similar

Microsec: "DV valid" test website certificate issued under incorrect root

AI Summary CA Owner

#1865880 RESOLVED Self Reported Incident Opened 2023-11-21 · Closed 2024-02-14 · 88% similar

Microsec: Findings in 2023 Audit

AI Summary CA Owner

#1925239 RESOLVED Self Reported Incident Opened 2024-10-17 · Closed 2025-01-14 · 87% similar

Microsec: Expired Certificates on test Pages for Revocation

AI Summary CA Owner

#2026351 RESOLVED Self Reported Incident Certificate Misissuance Opened 2026-03-25 · Closed 2026-05-18 · 82% similar

Identrust: Root CrossSign, of dedicated Roots, missing EKU

AI Summary CA Owner

#1622539 RESOLVED Self Reported Incident Opened 2020-03-14 · Closed 2023-02-22 · 82% similar

Microsec: Issuance of 2 IVCP precertificates without givenName, surName, localityName fields

AI Summary CA Owner

#1889699 RESOLVED Certificate Misissuance Incident Revocation Issue Opened 2024-04-04 · Closed 2024-08-28 · 82% similar

Microsec: Disallowed subject attribute field in DV certificate

AI Summary CA Owner

#1979475 RESOLVED Self Reported Incident Certificate Misissuance Opened 2025-07-26 · Closed 2026-01-20 · 81% similar

Microsoft PKI Services: End Entity Certificate Mis-issuance against CPS (BasicConstraints)

AI Summary CA Owner

#2007070 RESOLVED Self Reported Incident Certificate Misissuance Revocation Issue Opened 2025-12-19 · Closed 2026-03-30 · 81% similar

SECOM: Non conformant SCT Encoding Due to SCT Modification by Cybertrust Japan (CTJ)

AI Summary CA Owner