← China Financial Certification Authority (CFCA) cases
Bugzilla #2006333
Certificate Misissuance
CFCA: EV Certificates misissued with incorrect businessCategory
RESOLVED
FIXED
China Financial Certification Authority (CFCA)
AI Summary
The China Financial Certification Authority (CFCA) misissued Extended Validation (EV) certificates to Chinese government entities, incorrectly classifying them as 'Private Organization' instead of 'Government Entity'. This misclassification was due to a logic defect in their mapping system, which failed to accurately identify entity types based on registration authority prefixes. Following a Certificate Problem Report from security researchers, CFCA identified and revoked 43 affected certificates. They have since implemented corrective measures, including updates to their systems and processes to prevent future occurrences.
Chronology
- First EV certificate with incorrect businessCategory issued.
- Non-compliance identified through a Certificate Problem Report.
- Revocation of 16 affected certificates initiated.
- All 27 additional certificates identified were revoked.
- Closure report submitted after all action items completed.
Participants
Michael Songxinlei
Zeyu Wang
Jianjun Chen
External References
Similar Local Cases
CFCA: certificate with an incorrect OrganizationName
CFCA: BasicConstraints are not marked as critical certificates are missing and therefore not revoked
Hongkong Post / Certizen: Failure to report misissuance
Camerfirma: EV Certificates issued with wrong Business Category
GlobalSign: Incorrect RegNumber-Org Type combination
Sectigo: Incorrect EV businessCategory
NAVER Cloud Trust Services: OV certificate issued with OU field
Sectigo: test certificates issued from trusted CA