# What Is Misissuance (Certificate misissuance)?

> Misissuance is any certificate issuance that breaks the Baseline Requirements or a root program policy, from flawed validation to malformed fields.

Source: https://ssl.sh/glossary/misissuance/
Last updated: 2026-11-10

Misissuance covers two broad kinds of problem. The serious kind is a certificate issued to someone who does not control the domain, for example because of a flawed [DCV](https://ssl.sh/glossary/dcv/) method or ignored [CAA](https://ssl.sh/glossary/caa/) records. The more common kind is a certificate for the right owner that is still non-compliant: an invalid encoding, a forbidden extension, a validity period above the maximum, or a serial number with too little randomness. Both count, and a logged [precertificate](https://ssl.sh/glossary/precertificate/) counts as issuance even if the final certificate never appeared.

## Why it matters
Root programs expect a CA that finds or is told about misissuance to stop the cause, publish an incident report (Mozilla tracks these in its Bugzilla) and revoke the affected certificates within the Baseline Requirements deadline, generally 5 days for non-compliant certificates. Repeated incidents and slow or incomplete revocation are what lead to [distrust](https://ssl.sh/glossary/distrust/). Certificate Transparency made misissuance detectable: researchers run certificate linters such as zlint and pkilint over CT logs, and domain owners can spot certificates they never requested.

## Example
A CA discovers that a software change caused it to issue certificates with a malformed extension for a week. It must report the incident and revoke those certificates within 5 days. Affected site owners receive a notice and must replace their certificates quickly, which is why automated renewal, ideally driven by ACME Renewal Information, matters even for certificates that are nowhere near expiry.

## Common misconceptions
- **Misissuance means the certificate went to an attacker.** Most cases are technical compliance errors for the legitimate owner, but they still require revocation.
- **Small formatting errors do not matter.** Strict parsers can reject malformed certificates, and the rules require revocation regardless of perceived risk.
- **Certificate Transparency prevents misissuance.** It only makes misissued certificates visible after the fact.

## Related terms

- [证书透明度](https://ssl.sh/zh/glossary/certificate-transparency/): 证书透明度（CT）是一套公开、只可追加的日志系统，记录所有公开信任的 TLS 证书，让任何人都能审计 CA 签发了什么。
- [Baseline Requirements](https://ssl.sh/zh/glossary/baseline-requirements/): Baseline Requirements 是 CA/B 论坛制定的基线要求，规定公开信任的 CA 在验证、签发和吊销 TLS 服务器证书时必须遵守的规则。
- [证书吊销](https://ssl.sh/zh/glossary/revocation/): 证书吊销是 CA 在证书到期前宣布其作废的操作，通过 CRL 或 OCSP 对外公布，使客户端不再信任这张证书。
- [取消信任](https://ssl.sh/zh/glossary/distrust/): 取消信任是根证书计划作出的决定：不再信任某家 CA 的证书，可能是全部证书，也可能只针对截止日期之后签发的证书。
- [CAA 记录](https://ssl.sh/zh/glossary/caa/): CAA 记录是一种 DNS 记录，用来声明哪些证书颁发机构可以为该域名签发证书，所有公共 CA 签发前都必须检查。
- [预证书](https://ssl.sh/zh/glossary/precertificate/): 预证书是 CA 在正式签发前提交到 CT 日志的证书副本，带有“毒化”扩展而无法使用，用来换取 SCT。
- [DCV](https://ssl.sh/zh/glossary/dcv/): DCV 即域名控制权验证，是 CA 在签发证书前确认申请者确实控制证书中每一个域名的检查。