← Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) cases
Bugzilla #1390988
Certificate Problem Report
Consorci AOC: Non-BR-Compliant Certificate Issuance
RESOLVED
FIXED
Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert)
AI Summary
The Consorci Administració Oberta de Catalunya (Consorci AOC) faced issues with the issuance of non-BR-compliant certificates, specifically involving invalid DNS names. The CA was alerted to these problems through a Bugzilla report and discussions in the mozilla.dev.security.policy forum. In response, the CA confirmed that it had ceased issuing problematic certificates and implemented additional controls to prevent future occurrences. A total of 11 misissued certificates were identified, and the CA has since revoked them. The CA has committed to regular updates and improvements to their processes to ensure compliance with industry standards.
Chronology
- Initial report of non-compliance issues.
- CA confirmed cessation of problematic certificate issuance.
- CA implemented additional validation checks.
- Migration to BR-compliant certificate profiles completed.
- All previously issued non-compliant certificates revoked.
Participants
Kathleen Wilson
Francesc Ferrer
Ryan Sleevi
Gervase Markham
Wayne Thayer
External References
Similar Local Cases
Add Consorci AOC "old" hierarchy to OneCRL
Camerfirma: Non-BR-Compliant Certificate Issuance
Visa: Non-BR-Compliant Certificate Issuance
Consorci AOC: EC-SECTORPUBLIC insufficient serial number entropy
GlobalSign: Non-BR-Compliant Certificate Issuance -- RSA key smaller than 2048 bits
SECOM: Non-BR-Compliant OCSP Responders
Consorci AOC: OCSP responding good for non-issued certs by Consorci AOC root already solved
Consorci AOC: Problem reporting mechanism for Consorci AOC points to URL with invalid cert