DigiCert / Swiss Government: CommonName not in SANs

This case was opened to request an incident report for a specific subCA under DigiCert’s management, related to a misissuance issue where the CommonName was not included in the certificate Subject Alternative Name (SAN) fields. The bug was separated out from Bug 1389172 to focus on the Swiss Government subCA. DigiCert stated it first became aware of the problem on Aug 5, 2017 via a revocation email from Alex Gaynor. DigiCert then emailed the Swiss Government on Aug 6, 2017 requesting revocation of two certificates, and both certificates were revoked on Aug 7, 2017 at 8:41 CEST. DigiCert also reported receiving a verbal commitment from the Swiss Government to stop using the cross certificate, and later stated that the cross-cert expired, which it believed remediated the issue. The bug was closed as Resolved/Fixed, representing the Swiss Government’s remediation steps, with a note that follow-up on DigiCert’s broader remediation steps could be handled separately.

1. 2017-08-05 DigiCert received a revocation email indicating a problem with two Swiss Government certificates.
2. 2017-08-06 DigiCert requested revocation of two certificates from the Swiss Government.
3. 2017-08-07 Both problematic certificates were revoked.
4. 2017-09-10 The cross certificate expired.

1. 2017-09-07 Community commenter — Opened the separated bug to request an incident report specific to the Swiss Government subCA, noting the issue that the CommonName was not in SANs and referencing Bug 1389172.
2. 2017-09-09 Community commenter — Provided incident-report details including when DigiCert became aware (Aug 5, 2017), revocation request and revocation dates (Aug 6–Aug 7, 2017), and links to the problematic certificates via crt.sh IDs.
3. 2017-09-13 DigiCert — Stated that the cross-cert is expired, which he believed remediated the issue.
4. 2017-09-20 DigiCert — Summarized the timeline: problem report received Aug 5, revocation request Aug 6, revocations Aug 7, verbal commitment received Aug 7, and cross-cert expiry Sep 10.
5. 2017-09-20 Community commenter — Closed the bug as Resolved/Fixed, representing the Swiss Government’s remediation steps, with separate follow-up for DigiCert’s broader subordinate CA remediation.