DigiCert / Terena: Metadata in OU fields

This case was opened to request an incident report for TERENA, which DigiCert identified as a DigiCert sub CA. The issue concerned metadata being present in the certificate subject OU field. DigiCert stated that the problem was posted to the Mozilla dev list on Aug 9, 2017, and that DigiCert investigated the same day. DigiCert concluded that the situation was not a direct BR violation as written, explaining that OU is not an “other subject attribute” and is defined in the section immediately prior to this. DigiCert reported that it did not revoke the affected certificates, and it confirmed it had stopped issuing TLS/SSL certificates with the problem. DigiCert said it patched its systems to detect whether the OU field has metadata and prevents issuance if non-validated information is present, and it added OU metadata to a blacklist as it was discovered. The thread also states that DigiCert planned to validate all OU information prior to inclusion beginning in November 2017, to eliminate future OU metadata not currently blacklisted.

1. 2017-08-09 Issue about metadata in certificate subject OU fields was posted to the Mozilla dev list; DigiCert began investigating the same day.
2. 2017-08-10 DigiCert decided the issue was not a direct BR violation as written and added OU metadata to a blacklist to prevent further issuance.
3. 2017-11-01 DigiCert planned to begin validating all OU information prior to inclusion (ETA beginning of November 2017).

1. 2017-09-07 Community commenter — The bug was separated from Bug 1389172 to request an incident report specific to the TERENA subCA and asked for an incident report per Mozilla’s misissuance response guidance.
2. 2017-09-13 DigiCert — Jeremy Rowley explained that TERENA is a DigiCert sub CA, described DigiCert’s awareness and investigation, stated DigiCert did not revoke because OU is not an “other subject attribute,” and reported that DigiCert patched systems and added safeguards to prevent future OU metadata.
3. 2017-09-20 DigiCert — Jeremy provided a step-by-step timeline including the Aug 9 posting, Aug 10 determination and blacklist addition, and an ETA to validate OU information prior to inclusion beginning in November 2017.