← Autoridad de Certificacion Firmaprofesional cases
Bugzilla #2009941
Certificate Misissuance
Self Reported Incident
Firmaprofesional: Misissuance of TLS Subordinate CA "AC Firmaprofesional - Secure Web 2024"
RESOLVED
FIXED
Autoridad de Certificacion Firmaprofesional
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Firmaprofesional identified a misissuance involving the TLS Subordinate CA certificate 'Secure Web 2024', which included the 'organizationalUnitName' attribute, contrary to TLS Baseline Requirements. The issue was reported by an external party, prompting an internal investigation that confirmed the misissuance. The CA halted further issuance under this certificate and initiated revocation of the affected certificates. All remediation actions, including updates to compliance processes and certificate profile restrictions, have been completed, and the incident is now resolved.
Chronology
- TLS Subordinate CA 'Secure Web 2024' issued.
- External Certificate Problem Report received.
- Certificate issuance under the affected Subordinate CA stopped.
- Completion of revocation of 1137 TLS Subscriber certificates.
- Expected completion of revocation of the remaining TLS Subscriber certificate.
Thread Activity
- Logalty representative — Preliminary Incident Report submitted detailing the misissuance.
- Logalty representative — Full Incident Report submitted confirming the misissuance and outlining the timeline.
- Logalty representative — Acknowledged process failures in handling the Certificate Problem Report.
- Logalty representative — Report Closure Summary provided, confirming completion of all remediation actions.
Participants
Logalty representative
Google representative
Community commenter
Cabbage representative
External References
Similar Local Cases
Firmaprofesional: Policy Qualifiers other than id-qt-cps present for certificate
Firmaprofesional: 2020 Audit Report Finding 4 out of 4
Firmaprofesional: Incorrect publication of information for "Test Website - Revoked" URL in the CCADB.
Firmaprofesional: Delayed initial incident reporting for Bug 2016475 (72-hour preliminary and 14-day full report timing)
Telia: Certificates Issued with lower case value in subject:countryName
Izenpe: Duplicate attribute in Subject
Firmaprofesional: AC Firmaprofesional - INFRAESTRUCTURA insufficient serial number entropy
Firmaprofesional: 2021 Audit Report Finding 3 out of 3