← D-TRUST cases
Bugzilla #1390990
Certificate Problem Report
D-TRUST: Non-BR-Compliant Certificate Issuance
RESOLVED
FIXED
D-TRUST
AI Summary
D-TRUST faced issues with the issuance of non-Baseline Requirements (BR) compliant certificates, specifically regarding dNSName containing '/' and short serial numbers. The CA was required to provide a detailed remediation plan, which included stopping the issuance of problematic certificates and implementing changes to their validation processes. D-TRUST acknowledged the mistakes and outlined steps taken to prevent future occurrences, including enhancing their internal processes and communication with customers. The case was resolved with a commitment to compliance and regular updates on the remediation progress.
Chronology
- Issuance of problematic certificates stopped.
- Hotfix to validate CSR against RFC 5280 implemented.
- All certificates with short serial numbers revoked.
Participants
Kathleen Wilson
Arno Fiedler
Ryan Sleevi
Kim Nguyen
Enrico Entschew
External References
Similar Local Cases
D-TRUST: incorrectly formatted businessCategory entry
D-TRUST: Precertificate OU > 64 Characters
GlobalSign: Non-BR-Compliant Certificate Issuance -- RSA key smaller than 2048 bits
GlobalSign: Non-BR-Compliant Certificate Issuance - metadata-only subject fields
D-TRUST: syntax error in one tls certificate
certSIGN: Non-BR-Compliant OCSP Responders
DocuSign/Keynectis: Non-BR-Compliant Certificate Issuance
DigiCert: Certificate Issues Identified on the Mailing List