DigiCert: Certificate issued with commonName longer than 64 characters

This case reports that DigiCert issued a certificate whose commonName (CN) was too long. The bug was initiated after the issue was reported in the mozilla.dev.security.policy forum, referencing a specific certificate on crt.sh with a CN length of 67 characters. RFC 5280 defines an upper bound of 64 characters for the commonName field, and the reporter also noted DigiCert had other certificates with organizationName values that were too long. DigiCert stated it investigated the problem, determined the root cause was a test certificate issued by a DigiCert employee to test a path permitting CN fields greater than 64 characters, and that the policy against using live certificates for testing was not followed. DigiCert reported taking mitigation steps including revoking the system’s certificate, scanning for names that were too long, and patching the issuing system to fix the path and limit the string to 64 characters. DigiCert also stated that the scan found only the test certificate with the long CN. The bug was resolved as FIXED.

1. 2017-03-08 DigiCert began investigating the issuance of a certificate with an overlong commonName and revoked the affected certificate.
2. 2017-03-09 DigiCert patched its issuing system to enforce the 64-character commonName limit and scanned for any other overlong commonName values.

1. 2017-04-05 Mozilla representative — Reported that DigiCert issued a certificate with commonName too long (67 characters) and cited RFC 5280’s 64-character limit, including examples from crt.sh.
2. 2017-04-05 DigiCert — Said DigiCert reviewed RFC 5280 requirements, cut fields to correct length, and planned to continue a CAB Forum ballot to seek an exception because 64 characters is insufficient for international organizations.
3. 2017-09-20 Community commenter — Asked for a brief mitigation timeline and confirmation that all mitigations were in place to close older compliance bugs.
4. 2017-09-20 DigiCert — Provided a mitigation timeline: report and investigation on Mar 8, revocation and scanning on Mar 8, root cause explanation and patch deployment on Mar 9, and stated validation completed before issuance.
5. 2017-09-20 DigiCert — Confirmed the Mar 9 scan found only the long-CN test certificate.