NAVER Cloud Trust Services: Subordinate CA certificates with two Reserved Certificate Policy Identifiers
NAVER Cloud Trust Services reported that five subordinate CA certificates contained two Reserved Certificate Policy Identifiers in the Certificate Policies extension and did not contain anyPolicy. The report states this violated TLS Baseline Requirements Section 7.1.2.10.5, which requires a Policy Restricted CA certificate to contain exactly one Reserved Certificate Policy Identifier. NAVER said it had confirmed the issue and would revoke the affected certificates in accordance with Section 4.9.1.2. On 2026-10-19, NAVER said all five affected subordinate CA certificates were revoked with CRLReason superseded before the 7-day deadline. NAVER also said updated ARLs were published, root OCSP responders began returning revoked status, the revocations were recorded in CCADB, and replacement subordinate CAs were disclosed. A full incident report was promised for a later update.
- A Certificate Problem Report was received about five subordinate CA certificates with two Reserved Certificate Policy Identifiers.
- NAVER disclosed the incident and said it would revoke the affected certificates.
- NAVER revoked all five affected subordinate CA certificates and published updated revocation information.
- Navercorp representative — NAVER filed a preliminary incident report describing the policy identifier issue and said it had confirmed the issue and would revoke the affected certificates.
- Navercorp representative — NAVER reported that all five certificates were revoked before the deadline, updated ARLs were published, OCSP responders returned revoked status, and replacement subordinate CAs were disclosed.