DigiCert: Invalid Country Code Issuance
DigiCert reported that it had issued certificates containing invalid country codes in the certificate data. The Product team discovered on 2018-05-17 that certificates in DigiCert’s system were issued with two incorrect country codes, AN and XK, while addressing a revalidation question. DigiCert confirmed the issue with Engineering Manager and then removed the ISO country codes AN and XK from its CA issuance process via code changes. DigiCert stated it stopped issuing certificates using these country codes at the CA level. The thread lists 7 certificates associated with AN and 10 certificates associated with XK, including the first and last issuance dates for each code. DigiCert said the plan was to revoke the affected certificates, and later comments confirm that all of these certificates were revoked. The bug was resolved as FIXED.
- DigiCert discovered that certificates had been issued with incorrect country codes (AN and XK).
- DigiCert removed the AN ISO country code from its CA issuance process.
- DigiCert removed the XK ISO country code from its CA issuance process.
- DigiCert reported that all affected certificates had been revoked.
- DigiCert — Brenda Bernal described how DigiCert became aware of the issue, provided a timeline, listed affected certificates, stated issuance was stopped via code changes, and explained the cause and remediation steps.
- Fastly representative — Wayne Thayer asked whether DigiCert would also post the incident report to the mozilla.dev.security.policy forum.
- DigiCert — Brenda Bernal said the incident was posted to the mdsp forum and that CT logs were updated, asking if anything else was needed to move the bug to Resolved/Fixed.
- Fastly representative — Wayne Thayer asked whether DigiCert planned to replace and revoke the certificates or let them expire naturally, and requested the last expiration date if natural expiry was planned.
- DigiCert — Brenda Bernal responded that the plan was to revoke the affected certificates.
- DigiCert — Brenda Bernal reported that all the certificates had been revoked and asked if anything else was needed to close the bug.
- Fastly representative — Wayne Thayer confirmed that all of these certificates had been revoked.