Public comments on "No Meaningful Subject Distinguished Name"

Issuance Policy
,
22

What exactly defines the scope of "affected serials"?

23

It was for certificates that had only domain names longer than 64 characters such that the common name CN for the certificate was blank by necessity. This thread is for commenting on the issue so thank you for posting here. Details of the incident are here

8 Likes
24

Pretty close, but a lot more subcommands :wink:

7 Likes
25

Question: did these certificates violate CA/B rules, or were they just inconsistent with ISRG standards and needed to be revoked because of that?

4 Likes
26

It was only an issue with our own CP/CPS, which is why we could resume issuance as soon as it was updated.

7 Likes
27

And thus being in violation of the BR.

Edit: hm, the BR does mention compliance at the list of revocation reasons, but with a few minutes of searching I can't find the part where it actually says you need to revoke the certs? Anyone have better search-fu than I do?

3 Likes
28

Awesome. Thanks for the clarification. I was pretty sure it was that scenario. I didnā€™t expect an ā€œinternal complianceā€ revocation like that would necessitate a full public bugzilla report - which is why I asked above.

4 Likes
29

The Baseline Requirements, Version 2.0.8, Section 4.9.1.1:

the CA... MUST revoke a Certificate within 5 days... if... [t]he CA is made aware that the Certificate was not issued in accordance with... the CA's Certificate Policy or Certification Practice Statement

8 Likes
30

Ah, thanks, I searched for the abbreviations and "compliance", which did not result in that part.

7 Likes