Editing Verisign (section)

=== 2001: Code signing certificate mistake ===

In January 2001, Verisign mistakenly issued two Class 3 [[code signing]] certificates to an individual claiming to be an employee of [[Microsoft]].<ref>{{cite web|url=https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-017|title=Microsoft Security Bulletin MS01-017 - Critical: Erroneous VeriSign-Issued Digital Certificates Pose Spoofing Hazard|publisher=[[Microsoft]]|date=March 22, 2001|access-date=April 29, 2021}}</ref> The mistake was not discovered and the certificates were not revoked until two weeks later during a routine audit. Because Verisign code-signing certificates do not specify a Certificate Revocation List Distribution Point, there was no way for them to be automatically detected as having been revoked, placing Microsoft's customers at risk.{{citation needed|date=June 2012}} Microsoft had to later release a special security patch in order to revoke the certificates and mark them as being fraudulent.<ref>{{cite web|url=http://www.microsoft.com/en-us/download/details.aspx?id=11288|title=Windows Security Update: Verisign Digital Certificates Spoofing Hazard|publisher=[[Microsoft]]|date=March 28, 2001|access-date=June 30, 2012}}</ref>