Open Bug 2025231 Opened 3 days ago Updated 3 days ago

Chunghwa Telecom: Test Website certificate not revoked

Categories

(CA Program :: CA Certificate Compliance, task)

Product:
CA Program
Component:
CA Certificate Compliance
Type:
task

Tracking

(Not tracked)

Status:
ASSIGNED

People

(Reporter: tmkuo, Assigned: tmkuo)

Details

(Whiteboard: [ca-compliance] [policy-failure])

Preliminary Incident Report

Summary

  • Incident description: At 06:55 AM on March 22, 2026 (UTC+8), CHT received a notification from a third party regarding a certificate associated with our test website-revoked (https://revoked.epkiov.hinet.net/) recorded in CCADB. The certificate status was shown as valid rather than revoked, as expected, resulting in non-compliance with the applicable requirements.
  • Relevant policies: TLS BR Section 2.2

2.2 Publication of information
...
The CA SHALL host test Web pages that allow Application Software Suppliers to test their software with Subscriber Certificates that chain up to each publicly trusted Root Certificate. At a minimum, the CA SHALL host separate Web pages using Subscriber Certificates that are
i. valid,
ii. revoked, and
iii. expired.

  • Source of incident disclosure: Third Party Reported.

The Full Incident Report will be posted no later than April 5, 2026.

Summary: Chunghwa Telecomm: Test Website certificate not revoked → Chunghwa Telecom: Test Website certificate not revoked
Assignee: nobody → tmkuo
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true
Whiteboard: [ca-compliance] [policy-failure]
You need to log in before you can comment on or make changes to this bug.