Chunghwa Telecom: Issuance of certificate using keys previously reported as compromised

On January 23, 2026, Chunghwa Telecom (CHT) was notified of certificates issued using a private key that had previously been revoked due to key compromise. An investigation revealed that a missing system configuration allowed the issuance of certificates with compromised keys. A total of 8 affected OV certificates were identified, with 6 still valid at the time of detection. All affected certificates were revoked within 24 hours, and corrective measures were implemented to prevent future occurrences. CHT has committed to maintaining compliance with TLS Baseline Requirements and enhancing their validation processes.

1. 2026-01-23 Received third-party notification regarding compromised key usage.
2. 2026-01-30 Investigation completed, identifying 8 affected certificates.
3. 2026-02-04 Full incident report submitted.
4. 2026-02-11 Action items for remediation completed.
5. 2026-02-28 Incident report closure summary provided.