← DigiCert cases
Bugzilla #1262610
Ca Certificate Compliance
DigiCert ECCE 001 issuing TLS certificates without subject alternative name extension
RESOLVED
FIXED
DigiCert
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
The bug reports that DigiCert’s ECCE 001 sub-CA was issuing TLS web server certificates without a subject alternative name (SAN) extension. Mozilla’s Dana Keeler opened the case after observing certificate examples and linking to crt.sh entries showing the missing SAN extension. DigiCert’s Jeremy Rowley later confirmed with the customer that they had stopped issuing SSL/TLS certificates that do not include dNSNames in the subjectAltName extension. After this confirmation, the bug was closed as resolved with resolution set to FIXED. The thread indicates remediation occurred by stopping issuance of certificates lacking the SAN extension.
Chronology
- Mozilla reported that ECCE 001 was issuing TLS web server certificates without the subject alternative name extension.
- DigiCert confirmed the customer stopped issuing certificates without SAN.
Thread Activity
- Mozilla representative — Opened the bug noting that ECCE 001 was issuing TLS web server certificates without a subject alternative name extension and provided crt.sh links as examples.
- Mozilla representative — Asked Jeremy to confirm the customer had stopped issuing SSL certs without dNSNames in subjectAltName and to close the bug if confirmed.
- DigiCert — Confirmed with the customer that they no longer issue certs without a SAN.
Participants
Mozilla representative
DigiCert
Related Bugzilla IDs Mentioned
Similar Local Cases
DigiCert: TERENA: Insufficient validation of organizationalUnitName
DigiCert: SHA-256 hash algorithm used with ECC P-384 key
DigiCert: TI Trust Technologies Global CA issued certificate with no subject alternative name extension
DigiCert: Misissuance detected by PKIMetal
DigiCert: EV for Onion addresses without Tor Service Descriptor
DigiCert: Invalid localityName
DigiCert: Some certificates issued with CRLDPs that don’t exactly match CCADB disclosures
DigiCert: Subject Serial Numbers for Non-Commercial Entities