Chunghwa Telecom: Issuance of certificate using keys previously reported as compromised

Chunghwa Telecom reported an incident involving the issuance of certificates using a private key that had previously been revoked due to key compromise. The CA discovered this issue on January 23, 2026, following a third-party report. An investigation revealed that a total of 8 OV certificates were affected, with 6 still valid at the time of detection. All affected certificates were revoked within 24 hours, and system corrections were implemented to prevent future occurrences. A full incident report was submitted, detailing the root causes and remediation steps taken, including reinstating key compromise validation logic and enhancing compliance tracking.

1. 2026-01-23 Chunghwa Telecom became aware of certificates issued using a previously compromised key.
2. 2026-01-30 Investigation confirmed 8 affected certificates.
3. 2026-02-04 Full incident report submitted detailing the incident and corrective actions.
4. 2026-03-07 Final call for comments on the incident report before closure.

1. 2026-01-24 Cht representative — Preliminary incident report initiated, confirming certificates issued using a compromised key.
2. 2026-01-30 Cht representative — Investigation status update confirmed 8 affected certificates.
3. 2026-02-04 Cht representative — Full incident report submitted detailing the incident and corrective actions.
4. 2026-02-28 Cht representative — Report closure summary provided, detailing root causes and remediation.