On Sun, Sep 20, 2026 at 04:58:53PM +0000, Job Snijders wrote:
> Dear all,
> 
> AfriNIC completed their project to reissue all non-conformant
> certificates about a month ago: https://lists.afrinic.net/pipermail/dbwg/2026-August/000582.html
> 
> It should be noted that at the moment of writing there still is a very
> small contingent of CAs that ought to reissue some signed objects. This
> can be traced back to behaviour in some versions of krill Krill that
> will byte-for-byte reflect the subject as designated by the issuer
> even if the issuer used an invalid encoding. This came to light after
> a regression in APNIC's signer system. Between January 28th, 2026 and
> March 3rd, 2026 APNIC inadvertently issued resource certificates with
> UTF8String-encoded issuers & subjects (instead of PrintableString).
> APNIC resolved the incident and revoked/reissued all nonconforming
> certificates under APNIC's control, and Krill instances seem to slowly
> be picking up the rectification. https://github.com/NLnetLabs/krill/issues/1394
> 
> Time to tighten the thumbscrews. OK?

Absolutely. Yes please!

ok tb