CFCA countryName misissuance incident expanded to seven certificates after re-verification
CFCA’s case concerns OV subscriber certificates that were issued with `subject:countryName` values that did not match the country associated with the subject. The incident was first reported by a third party, and CFCA initially identified four affected certificates, all of which were revoked or already revoked. After later review prompted by additional CT records, CFCA re-verified its issuance records across all issuing CAs and said the corrected impact was seven certificates, with the non-compliance start date moved back to 2018-04-20. CFCA also confirmed that two additional historical records were mis-issuances under the same root cause, and that a September 2026 certificate was a negative test case during release verification of the new country-validation feature and was revoked shortly after issuance. CFCA reported that automated `subject:countryName` validation has been implemented and verified, and that all seven affected certificates are revoked or expired. The bug remains ASSIGNED.
- A CFCA certificate was issued with an incorrect `subject:countryName` value.
- A CFCA certificate was issued with an incorrect `subject:countryName` value.
- A CFCA certificate was issued with an incorrect `subject:countryName` value and later replaced with a compliant certificate.
- A CFCA OV subscriber certificate was issued with an incorrect `subject:countryName` value.
- A third-party CPR was received about the incorrect countryName values.
- A certificate was issued during release verification of the new country-validation feature and later revoked.
- China Financial Certification Authority (CFCA) — CFCA opened a preliminary incident report describing three reported certificates and one additional certificate with unexpected country code values in `subject:countryName`.
- China Financial Certification Authority (CFCA) — CFCA said all four initially identified certificates had been addressed within the 5-day timeframe, with three revoked and one already revoked before the CPR.
- China Financial Certification Authority (CFCA) — CFCA filed the full incident report with the non-compliance dates, impact, root cause, and planned automated validation.
- Community commenter — A commenter raised questions about appendix format, action-item mapping, audit scope, and interim controls.
- China Financial Certification Authority (CFCA) — CFCA said it would update the appendix format, remove the delayed CPR response reference from this report, and keep the remediation focused on the countryName issue.
- China Financial Certification Authority (CFCA) — CFCA said all action items were completed, including revocation of remaining valid certificates and deployment of automated countryName validation.
- China Financial Certification Authority (CFCA) — CFCA corrected the report’s policy citation and said the updated report reflected completion of both action items.
- China Financial Certification Authority (CFCA) — CFCA posted a closure summary stating that all four certificates were revoked, automated validation was implemented and verified, and the report was ready for closure.
- Community commenter — A commenter asked CFCA to reconcile additional CT records with the incident scope, timeline, and remediation before closure.
- China Financial Certification Authority (CFCA) — CFCA said it was reconciling the additional records across all issuing CAs and would post another update by 2026-10-12.
- China Financial Certification Authority (CFCA) — CFCA said its re-verification found additional mis-issuances, corrected the impact to seven certificates, and reported that four issuing CAs had been checked with two still in progress.