1266501 - Certinga: certificate with invalid date format

Status: RESOLVED FIXED

(CA Program :: CA Certificate Root Program, task)

Description

[Kurt Roeckx]

Hi,

This certificate:
https://crt.sh/?id=16843038&opt=cablint,x509lint

Has the not valid after set using Generalized Time instead of UTCTime.  It's doing it correctly for not valid before.

https://tools.ietf.org/html/rfc5280#section-4.1.2.5 clearly states that dates before 2050 should use UTCTime.

Comment 1

[Josselin Allemandou]

The problem has been identified by our teams and is being processed.

Comment 2

[Josselin Allemandou]

We have identified and corrected the problem which concerned the renewal process on which an update has been applied in january. After control, we have identified the few certificates concerned by the use of « GeneralizedTime » in the field « Not after ». We are currently contacting the Certificate managers to operate the revocation and change of their certificate. We will informe you shortly when all certificates concerned will be replaced.

Comment 3

[Josselin Allemandou]

Hi,

We wish to inform you that the majority of relevant certificates have already been replaced, including one designated in this bug.

We remain at your disposal for any further information.

Thank you in advance for your reply.

Comment 4

[Josselin Allemandou]

Attachment: CERTIGNA - BR Self Assessment v1.4.xlsx

New version of our BR Self Assessment to integrate the updates relating to "DNS CAA" and "Certificate transparency".