CFCA: EV Certificates misissued with incorrect businessCategory

The China Financial Certification Authority (CFCA) identified that several Extended Validation (EV) certificates issued to Chinese government entities were incorrectly classified as 'Private Organization' instead of 'Government Entity'. This misclassification was discovered following a Certificate Problem Report from security researchers on December 5, 2025. CFCA confirmed 16 affected certificates, of which 14 were active and revoked by December 12, 2025. A subsequent inspection revealed an additional 27 certificates with similar issues, all of which were revoked by December 26, 2025. CFCA has since implemented corrective measures, including updates to their system logic and enhanced vetting processes to prevent future occurrences.

1. 2025-12-05 CFCA received a Certificate Problem Report from security researchers regarding misclassification of EV certificates.
2. 2025-12-12 CFCA revoked 14 non-compliant certificates identified in the initial report.
3. 2025-12-26 CFCA completed the revocation of an additional 27 certificates found during further inspection.
4. 2026-03-03 CFCA submitted a closure report after completing all action items related to the incident.

1. 2025-12-16 Community commenter — CFCA identified misissued EV certificates and began the investigation.
2. 2025-12-22 Community commenter — CFCA found 27 more EV certificates with the same issue and initiated revocation.
3. 2026-01-13 Community commenter — CFCA provided a full incident report detailing the misissuance and corrective actions taken.
4. 2026-03-03 Community commenter — CFCA submitted the closure report as all action items were completed.