Camerfirma: certs with duplicate SANs and without localityName or stateOrProvinceName

This case involves Camerfirma, which discovered that some of its certificates were issued with duplicate Subject Alternative Names (SANs) and without the required localityName or stateOrProvinceName. The issue was identified during an internal review and subsequently reported to Mozilla. Camerfirma communicated the problem to affected customers, initiated revocation of the incorrectly issued certificates, and began reissuing compliant certificates. By April 24, 2017, all affected certificates had been re-issued, and the majority of the problematic certificates were revoked. The case has been resolved with all actions completed.

1. 2017-04-14 Camerfirma discovered issues with certificate issuance.
2. 2017-04-17 Mozilla was notified about the issues and opened this bug.
3. 2017-04-20 Camerfirma confirmed the bug was fixed and began reissuing certificates.
4. 2017-04-24 All affected certificates were re-issued and most were revoked.

1. 2017-04-17 Mozilla representative — Reported issues with Camerfirma certs having duplicate SANs and missing locality information.
2. 2017-04-17 WoSign CA Limited — Confirmed awareness of the issue and stated that fixes were underway.
3. 2017-04-20 WoSign CA Limited — Provided updates on the resolution of the issues and the re-issuance of certificates.
4. 2017-04-24 WoSign CA Limited — Confirmed that all wrongly issued certificates had been re-issued.
5. 2017-09-22 WoSign CA Limited — Submitted an incident report detailing the issues and resolutions.