← Visa cases
Bugzilla #2032468
Certificate Misissuance
VISA: Misissuance detected by PKIMetal
ASSIGNED
Visa
AI Summary
Visa has acknowledged a misissuance incident involving certificates issued under the Visa Public RSA Root CA that exceeded the maximum validity period allowed by the CA/Browser Forum Baseline Requirements. The issue was identified on April 16, 2026, and involved 233 certificates, with 124 deemed affected. Visa is currently transitioning to a new root, the Visa TLS Root CA, to ensure compliance and has initiated a replacement and revocation plan for the affected certificates. The community has raised concerns regarding the timeliness and transparency of Visa's responses and the adequacy of their compliance processes.
Chronology
- Transition strategy defined for Visa Public RSA Root CA.
- CCADB inclusion requests submitted for Visa TLS Root CA.
- New maximum validity period for TLS certificates takes effect.
- Misissuance identified by PKIMetal.
- Non-compliance ended with updated processes.
Participants
ijeun@visa.com
incident-reporting@ccadb.org
trusten.sec@gmail.com
rdaurne77@gmail.com
Zacharias.bjorngren@gmail.com
External References
Similar Local Cases
Firmaprofesional: Misissuance of TLS Subordinate CA "AC Firmaprofesional - Secure Web 2024"
Microsoft PKI Services: Misissuance detected by PKIMetal
IdenTrust: Cross-signed root certificate mis-issuance
SHA-1 issuance by Visa root
CCA India: Misissuance detected by PKIMetal
Government of Korea: Misissuance detected by PKIMetal
OATI: Misissuance detected by PKIMetal
DigiCert: Misissuance detected by PKIMetal