← Disig, a.s. cases
Bugzilla #2007132
Certificate Misissuance
Self Reported Incident
Disig: Certificates with invalid embedded SCT signature
RESOLVED
FIXED
Disig, a.s.
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Disig, a CA, discovered that four end-user OV certificates contained an invalid embedded Signed Certificate Timestamp (SCT) signature. Following this internal investigation, all affected certificates were revoked. A full incident report was initiated, detailing the root cause as a failure to preserve CT log response data during certificate assembly. Disig has implemented corrective actions, including the removal of the problematic CT log server from their active submission list and the integration of a new linter into their pre-issuance pipeline to prevent future occurrences. The incident is now resolved with all action items completed.
Chronology
- Disig identified invalid SCT signatures in four OV certificates and revoked them.
Thread Activity
- Disig, a.s. — Preliminary Incident Report submitted detailing the invalid SCT signatures.
- Disig, a.s. — Full Incident Report provided with a timeline and root cause analysis.
- Disig, a.s. — Report Closure Summary submitted, confirming all action items have been completed.
Participants
Disig, a.s.
CCADB representative
Mm representative
External References
Similar Local Cases
Disig: TLS certificate with basicConstraints not marked as critical
Disig: Delayed Full Incident Report
Disig: Non-BR-Compliant Certificate Issuance
Disig: Certificates with incorrect Subject attribute order
Disig: Two certificates with same serial number
Disig: CRL contains not allowed attributes
Disig: Multi-purpose Subordinate CA with missing EKU
IdenTrust: Cross-signed root certificate mis-issuance