CFCA incident: incorrect countryName values in four OV subscriber certificates
CFCA disclosed an incident involving four OV subscriber certificates that contained incorrect ISO 3166-1 country codes in the subject:countryName field. The issue was first identified through a third-party report, and CFCA then found one additional affected certificate during its investigation. CFCA said the incorrect country codes were present in the applicants' CSRs and were not caught during manual review because automated validation was not yet in place. CFCA reported that all four certificates were addressed, with three revoked on 2026-08-01 and one already revoked before the CPR. In later thread activity, CFCA said it would update the incident report appendix to the required format, remove the delayed CPR response reference from this report, and keep the remediation focused on the countryName issue. The bug remains ASSIGNED, and CFCA said on 2026-09-12 that it was still monitoring the incident with no further updates yet.
- A CFCA OV subscriber certificate for *.jhccb.com.cn was issued with C=MO.
- A CFCA OV subscriber certificate for jmm.ibinzhou.net was issued with C=CF.
- A CFCA OV subscriber certificate for *.haining.gov.cn was issued with C=CF.
- A CFCA OV subscriber certificate for *.nstad.cn was issued with C=CL.
- A CPR was received via the CCADB CPR form about the incorrect countryName values.
- Three affected certificates were revoked and one was confirmed already revoked before the CPR.
- China Financial Certification Authority (CFCA) — CFCA opened a preliminary incident report describing three reported certificates and one additional certificate with unexpected country code values in subject:countryName.
- China Financial Certification Authority (CFCA) — CFCA listed the four affected certificates, their serial numbers, crt.sh IDs, and incorrect country codes.
- China Financial Certification Authority (CFCA) — CFCA said all four certificates had been addressed within the 5-day timeframe, with three revoked and one already revoked before the CPR.
- China Financial Certification Authority (CFCA) — CFCA corrected the revocation timing for the three certificates to 2026-08-01 around 14:00-14:16.
- China Financial Certification Authority (CFCA) — CFCA filed the full incident report, giving the non-compliance dates, impact, root cause, and planned automated validation.
- China Financial Certification Authority (CFCA) — CFCA reposted the full incident report with the same incident details and timeline.
- Community commenter — A commenter raised observations about the incident report format, action-item mapping, audit scope, and interim controls.
- China Financial Certification Authority (CFCA) — CFCA said there were no further updates about the action items yet and that another comment would follow later.
- China Financial Certification Authority (CFCA) — CFCA said it would update the appendix format, keep the 'where we got lucky' field as N/A, remove the delayed CPR response reference from this report, and keep the remediation focused on the countryName issue.
- China Financial Certification Authority (CFCA) — CFCA said it was monitoring the incident and had no further updates yet.
- China Financial Certification Authority (CFCA) — CFCA again said there were no further updates and that it would keep monitoring the incident.
- China Financial Certification Authority (CFCA) — CFCA said it was monitoring this incident and had no further updates yet.