PostSignum: Mis-issued certificate

PostSignum reported a mis-issuance incident involving a TLS certificate issued with unverified data due to a human error during a service intervention. The CA operator mistakenly selected the operational certificate policy instead of the test policy while issuing a test certificate. The mis-issued certificate was identified and revoked within minutes of issuance. PostSignum has since implemented new internal procedures and training for CA operators to prevent similar incidents in the future, including a requirement for dual operator verification for certificate issuance from the CA core. The incident report has been completed and is now closed.

1. 2026-02-10 Mis-issued certificate identified and revoked

1. 2026-02-13 Cpost representative — Preliminary Incident Report Summary submitted.
2. 2026-02-20 Cpost representative — Full Incident Report detailing the mis-issuance and corrective actions taken.
3. 2026-03-06 Cpost representative — Report Closure Summary provided, confirming completion of remediation actions.
4. 2026-03-10 CCADB representative — Final call for comments on the Incident Report before closure.