Chunghwa Telecom: Issuance of certificates using keys previously revoked for key compromise
Chunghwa Telecom reported an incident in which its issuance system accepted CSRs that reused private keys from certificates previously revoked for keyCompromise. The issue was first disclosed after a third-party report on 2026-01-23, and the CA then investigated the scope of the problem. The investigation found 8 affected OV certificates in total, including certificates that were valid at the time of discovery and others that had already expired. Chunghwa Telecom said the affected certificates were revoked within 24 hours and that system parameter corrections were introduced to prevent future issuance using reported compromised keys. The final report states that the missing key-compromise validation logic was reinstated, a linked-revocation feature was implemented, and additional configuration and compliance tracking updates were completed. The bug was later marked resolved, and a duplicate bug was noted on 2026-09-30.
- A certificate was reported as having been issued using a private key previously revoked for key compromise.
- Chunghwa Telecom identified the incident and began investigating affected certificates.
- Chunghwa Telecom submitted its full incident report.
- Chunghwa Telecom submitted its report closure summary and requested closure.
- Bug 2076204 was marked as a duplicate of this bug.
- Cht representative — Chunghwa Telecom filed a preliminary incident report saying it had found certificates issued using a key previously revoked for keyCompromise and had revoked affected certificates within 24 hours.
- Cht representative — Chunghwa Telecom said its investigation was complete and that 8 certificates were affected.
- CCADB representative — CCADB asked whether the affected certificates were DV, OV, or another type.
- Cht representative — Chunghwa Telecom replied that the 8 affected certificates were OV certificates.
- Cht representative — Chunghwa Telecom posted its full incident report describing the missing system configuration and the remediation steps taken.
- Cht representative — Chunghwa Telecom posted an action-items update showing several remediation items completed and one tracking-list update delayed.
- Community commenter — A commenter asked what delay affected the compliance-tracking-list action item and whether there was a new due date.
- Cht representative — Chunghwa Telecom said it wanted to conduct a more comprehensive review and would provide the exact due date after assessment.
- Cht representative — Chunghwa Telecom said it had updated the compliance tracking list and completed the delayed action item.
- Cht representative — Chunghwa Telecom posted its closure summary, restating the root cause, revocation actions, and remediation measures, and requested closure.
- CCADB representative — CCADB issued a final call for comments and said the bug would be closed around 2026-03-07.
- CCADB representative — CCADB marked Bug 2076204 as a duplicate of this bug.