FNMT-RCM: Issuance of EV/OV certificate using previously revoked keyCompromise key

FNMT-RCM reported an incident in which it was informed by a third party that a TLS certificate had been mis-issued using a private key that had previously been revoked with reason code "keyCompromise". The compliance team investigated and determined that the incident violated CAB Forum Baseline Requirements section 6.1.1.3 (subscriber key pair generation), which requires rejecting certificate requests when the applicant’s private key has previously been notified as key compromised. FNMT-RCM stated that it scanned certificates and found two additional affected certificates, but those were already expired; within 24 hours of becoming aware, the affected active certificate was revoked with reason "key compromised". FNMT-RCM also reported that issuance was stopped during investigation, a script to detect compromised keys was installed, and the issuance service was later reactivated. In its remediation, FNMT-RCM stated that it implemented application changes to check whether a key is compromised and configured scheduled automated scans to detect certificates issued with compromised keys. The incident report closure summary states that the action items were completed and requests closure, and the bug is marked RESOLVED with resolution FIXED.

1. 2025-02-13 Certificate "B" was issued using the same CSR/key as a previously issued certificate that would later be revoked for key compromise.
2. 2026-01-23 FNMT-RCM was informed by a third party of TLS certificate mis-issuance involving a previously revoked keyCompromise key.
3. 2026-01-23 FNMT-RCM revoked the affected active certificate within 24 hours with reason "key compromised".
4. 2026-02-20 FNMT-RCM submitted a report closure summary stating remediation actions were completed and requested closure.

1. 2026-01-25 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Opened a preliminary incident report stating FNMT became aware of a certificate issued using a previously revoked keyCompromise key and that the certificate was revoked within 24 hours, with a full incident report planned.
2. 2026-01-30 CCADB representative — Asked whether the affected certificate was DV, OV, or another type.
3. 2026-02-01 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Responded that the affected certificate was an EV certificate.
4. 2026-02-06 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Submitted the full incident report describing third-party disclosure, identification of additional affected (expired) certificates, revocation within 24 hours, and remediation steps including stopping issuance and installing a compromised-key detection script.
5. 2026-02-09 Google representative — Requested updates to the timeline and asked about FNMT’s monitoring process for the Bugzilla CA Certificate Compliance component and why related incidents did not trigger earlier review.
6. 2026-02-13 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Provided clarifications on the non-compliance start date, described monitoring and planned improvements, and explained why earlier incidents did not trigger earlier automated scans.
7. 2026-02-13 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Republished the incident report with updated timeline and status of action items.
8. 2026-02-20 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Posted the report closure summary stating the incident description, root causes, remediation actions (revocation, application fix, scheduled automated scans), and that action items were completed and closure was requested.
9. 2026-02-20 CCADB representative — Issued a final call for comments and noted the bug would be closed approximately 2026-02-27.