DigiCert / Symantec: EV JOI Issue

This case reports a misissuance of EV certificates where the Jurisdiction of Incorporation (JOI) fields were incorrect. DigiCert (covering systems acquired from Symantec) stated that on 2017-07-20 a validation analyst identified and reported an existing EV certificate with incorrect JOI fields, and that additional certificates were found through further investigation. The CA investigated to determine whether the issue was systemic, then escalated the case on 2017-10-04 and identified and verified a cause on 2017-10-05. DigiCert applied software patches on 2017-10-05 (with additional updates on 2017-10-10 and 2017-10-25) to correct the JOI information source and add safeguards, including forcing certificates into manual review. Symantec stopped issuing certificates with the problem as of 2017-10-10. The CA reported finding 387 EV certificates with incorrect JOI fields, revoking the 108 still valid certificates, and noting that the remaining 279 were already revoked or expired; Mozilla indicated no further action was needed if the systems were patched and the certificates were revoked. The bug is marked RESOLVED with resolution FIXED.

1. 2017-07-20 A validation analyst identified an existing EV certificate with incorrect JOI fields.
2. 2017-10-05 Cause was identified and verified, and software patches were applied to correct JOI information handling.
3. 2017-10-10 Symantec stopped issuing certificates with the incorrect JOI problem and revocation of impacted certificates began/continued within the stated timeframe.

1. 2017-11-02 DigiCert — Reported the EV certificate misissuance with incorrect JOI fields, provided a timeline of investigation, patching, and revocation, and stated Symantec stopped issuing as of 2017-10-10.
2. 2017-11-15 DigiCert — Asked how Mozilla would like to proceed, noting no new information.
3. 2017-11-15 Mozilla representative — Indicated that if systems were patched and certificates were revoked, there should be no further action.