← China Financial Certification Authority (CFCA) cases
Bugzilla #2080755
Ca Certificate Compliance
Incident
Self Reported Incident
Certificate Misissuance
Revocation Issue
CFCA preliminary incident report: eleven certificates used lowercase subject:countryName
ASSIGNED
China Financial Certification Authority (CFCA)
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
CFCA opened this bug as a preliminary incident report after a systematic search identified eleven certificates with a lowercase subject:countryName value ("cn"). The report says the certificates were issued between 2013-03-07 and 2021-12-30, and that all eleven have expired. Four of the certificates had already been revoked, while seven expired without revocation. CFCA cites BR v2.3.1 section 7.1.2.7.4 and EVG v2.0.4 section 7.1.4.2.6 as the relevant policy requirements for the countryName field. The report also states that the source of the incident disclosure was a third-party report, and it references Bug 2058918 comment 16 as the trigger for the search.
Chronology
- One affected certificate was issued with lowercase subject:countryName.
- The last affected certificate in the reported set was issued with lowercase subject:countryName.
- CFCA filed a preliminary incident report identifying eleven affected certificates.
Thread Activity
- China Financial Certification Authority (CFCA) — CFCA reported that a systematic search found eleven certificates with lowercase subject:countryName, noted that all had expired, and said four were revoked while seven expired without revocation.
Participants
China Financial Certification Authority (CFCA)
External References
Related Bugzilla IDs Mentioned
Similar Local Cases
CFCA: CRL signatureAlgorithm Missing NULL Parameter (RFC 4055 Section 5)
CFCA: Cross-signed certificate missing the Extended Key Usage (EKU) extension
CFCA: O > 64 characters
CFCA: DV OCA caIssuers Returns PEM Encoded Certificate (RFC 5280 Section 4.2.2.1 Violation)
CFCA: Wrong SerialNumber encoding
CFCA: OCSP Responder Certificate Profile Deviations and OCSP Service Issues
eMudhra emSign PKI Services: TLS certificates missing certificate-type policy OID required by CP/CPS
eMudhra emSign PKI Services: TLS certificates exceed CP/CPS maximum validity period by one second