← DigiCert cases
Bugzilla #1429639
Ca Certificate Compliance
Self Reported Incident
DigiCert: BR 3.2.5 Validation of Authority Failure for OV Certs
RESOLVED
FIXED
DigiCert
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
DigiCert reported a compliance failure regarding the validation of OV certificate requests due to a bug in their OEM integration. This issue allowed the use of constructed email addresses for authenticity verification, which did not meet the required standards. The problem was discovered by TBS Internet on December 30, 2017, and DigiCert took immediate action to disable email verification and began revalidating affected certificates. A total of 5,067 certificates were identified as potentially problematic, with 3,437 organizations impacted. As of June 2, 2018, DigiCert had completed the remediation process, revoking 35 certificates that could not be validated.
Chronology
- DigiCert received a report about the validation issue.
- DigiCert disclosed the incident to Mozilla.
- DigiCert completed the remediation process.
Thread Activity
- Fastly representative — Tim Hollebeek from DigiCert posted the incident report detailing the validation failure.
- DigiCert — Revalidation is ongoing, and a timeline is being established.
- DigiCert — DigiCert finished the remediation of the affected certificates.
Participants
Community commenter
External References
Similar Local Cases
DigiCert: Issuance of Cert with Compromised Key
DigiCert: Verizon mis-issued test certificates
DigiCert / Justica: Invalid DNS names
DigiCert: Failure to properly encode Subject name
DigiCert: OCSP NextUpdate
DigiCert: Invalid stateOrProvinceName
DigiCert: Incorrect RegNumber-Org Type combination
DigiCert / Wells Fargo: Invalid DNS names