1301545 - GlobalSign CloudSSL CA - SHA256 - G3 issued certificate without required extensions

Status: RESOLVED FIXED

(CA Program :: CA Certificate Root Program, task)

Description

[Dana Keeler (she/her) [:keeler]]

Recently GlobalSign CloudSSL CA - SHA256 - G3 issued a certificate with no subject alternative name extension, no authority information access extension, and no certificate policies extension: https://crt.sh/?id=23431588&opt=cablint

Comment 1

[Kathleen Wilson]

Steve and Richard, please resolve this bug.

Comment 2

[Steve Roylance]

Hi David, Kathleen

An Engineer performed issuance based on a test CSR for a domain owned by GMO GlobalSign KK.  The purpose of the test was to check on the speed of issuance from the system and it was felt by the engineer (incorrectly) that a direct request would be the best method.  The direct issuance was allowed as the engineer had direct access as a trusted individual.   What he failed to realise is that this method did not impose the policy controls, hence no SAN was added etc.

We will be amending our system to enforce policy from direct manual issuance as well as from system issuance.

The mistake was realised within 71 minutes and the certificate was revoked.  

I have attached the certificate, a CRL showing it's revoked and a screen shot of these plus WHOIS details.

Apologies for the human error and have a good weekend.

Steve

Comment 3

[Steve Roylance]

Attachment: Human Error issuance of test certificate.PNG

Comment 4

[Steve Roylance]

Attachment: CloudSSL- Bad SAN Test Certificate.cer

Comment 5

[Steve Roylance]

Attachment: CRL showing the Certificate Revocation - cloudsslsha2g3.crl