Asseco DS / Certum: EV certificate mis-issue
The case reports an EV (extended validation) certificate mis-issuance by Certum (Asseco/Certum) for domain zegarownia.pl. The EV certificate’s “Green bar”/subject information contained “ZEGAROWNIA” as the organization name, which the reporter stated was not the legally registered company name; the legal company name was given as “57 Concepts Sp. z o.o. Sp.k.” Mozilla asked Certum to review the referenced certificate and either explain how it was properly issued or file an incident report if it was misissued. Certum responded that the issue was an isolated incident caused by human error when manually correcting the certification request, specifically placing trademark “Zegarownia” in the Organization Name field while the legal company name was placed in the Organizational Unit Name field. Certum revoked the misissued EV certificate on April 10, 2018, and later provided an incident report describing the investigation, including that they found another EV certificate with an incomplete owner name in organizationName and revoked both certificates. Certum stated that vetting procedures were reviewed and the validation team was re-trained on CA/Browser Forum requirements for SSL and EV SSL certificates. The bug is resolved as FIXED.
- Certum issued an EV certificate for zegarownia.pl with subject/organization naming that did not match the legally registered company name as reported.
- Certum revoked the misissued EV certificate 919DCADE40713F715E560005E868BAB18142DD97.
- Certum revoked a second EV certificate identified during review (022099F0DD4F0B16917884F49A61F6F9927EEE95).
- Certum reported that vetting procedures were reviewed and the validation team was re-trained on SSL/EV SSL requirements.
- Trustnet representative — Reported that Certum mis-issued an EV certificate for zegarownia.pl because the EV “Green bar”/subject organization name used “ZEGAROWNIA” instead of the legal company name “57 Concepts Sp. z o.o. Sp.k.”
- Fastly representative — Asked Arkadiusz to review the referenced certificate and either confirm proper issuance or file an incident report if it was misissued.
- Community commenter — Questioned whether Certum would issue an EV certificate with any string requested.
- Asseco Data Systems S.A. — Stated that Certum verified the trademark “Zegarownia” and applicant identity, said the incident was human error in field placement, and reported revocation of the certificate on April 10, 2018.
- Fastly representative — Requested a full incident report and asked whether Certum looked for additional certificates with the same problem and what prevention steps would be taken.
- Assecods representative — Provided an incident report describing the investigation, identified a second EV certificate with an incomplete organizationName, and stated both certificates were revoked; also described the cause as human error during manual correction.
- Fastly representative — Asked what steps had been or would be taken to prevent the issues from happening again.
- Assecods representative — Reported that vetting procedures were reviewed and the validation team was re-trained on CA/Browser Forum requirements for SSL and EV SSL certificates.