Chunghwa Telecom: Test Website certificate not revoked
Chunghwa Telecom (CHT) received a notification from a third party on 2026-03-22 that its test website (https://revoked.epkiov.hinet.net/) was serving a certificate recorded in CCADB as valid rather than revoked, which CHT stated was non-compliant with TLS Baseline Requirements Section 2.2 publication of information. CHT’s incident report says the non-compliance began on 2026-03-12 and ended on 2026-03-22. In the reported timeline, a scheduled automated script issued and revoked some test certificates, but a manual certbot renew command was executed for the FQDN while the revocation procedure (certbot revoke) was inadvertently omitted. After receiving the third-party report, CHT’s PKI Incident Response Team revoked the affected certificate on 2026-03-22. The report also states that CHT conducted a comprehensive review of all test certificates and enhanced the test certificate automation workflow and implemented a test certificate status monitoring mechanism. CHT requested closure, and the CCADB incident reporting process indicated a final call for comments before closing around 2026-04-24.
- A scheduled automated process issued and attempted to revoke test certificates, but a later manual issuance for revoked.epkiov.hinet.net omitted the revocation step.
- A third party reported that the test website was serving a valid certificate instead of the required revoked certificate; CHT then revoked the affected certificate.
- CHT submitted a final incident report describing root cause, remediation, and requesting closure.
- Cht representative — Filed a preliminary incident report stating a third party reported that the test website-revoked certificate was shown as valid in CCADB, causing non-compliance with BR Section 2.2.
- Cht representative — Posted the full incident report with timeline, impact (1 certificate), root cause (revocation omitted during manual step and lack of automated monitoring), and remediation (immediate revocation and workflow/monitoring improvements).
- Cht representative — Stated that CHT was continuing to monitor the issue.
- Cht representative — Stated that CHT was continuing to monitor the issue.
- Cht representative — Provided additional incident report text including remediation details and requested closure after stating all action items were completed.
- CCADB representative — Issued a final call for comments and indicated the incident would be closed approximately 2026-04-24.