SwissSign: Domain validated certificate issued with stateOrProvinceName

SwissSign reported that it issued domain validated (DV) certificates containing a stateOrProvinceName (stateOrProvinceName) attribute, which it identified through its regular quality checks of crt.sh. The CA said it became aware of the issue on 2018-07-06 after crt.sh showed DV certificates with stateOrProvinceName (with examples linked from crt.sh). SwissSign stated that it stopped issuing this type of certificates on 2018-07-06 08:00 UTC. It also said it began informing customers and asked for revocation of the affected certificates on 2018-07-06 10:00 UTC, and that all affected certificates were revoked by 2018-07-31. The CA provided a description of how the mistake occurred, stating that during the process to include the DV OID, it was not checked whether customer-specific configurations were in line with the requirements defined by the DV OID. For remediation, SwissSign said it would add a dedicated check in future configuration changes affecting new certificates to ensure historical explained exceptions do not conflict with DV OID requirements. The bug is marked RESOLVED with resolution FIXED.

1. 2018-07-06 SwissSign identified via crt.sh that it had issued DV certificates containing stateOrProvinceName and stopped issuing this type of certificate.
2. 2018-07-06 SwissSign began informing customers and requested revocation of affected certificates.
3. 2018-07-31 SwissSign stated that all affected certificates were revoked.

1. 2018-07-06 SwissSign AG — SwissSign reported that it issued DV certificates with stateOrProvinceName and linked crt.sh examples, stating it would provide an incident report as described in Mozilla’s misissuance response guidance.
2. 2018-08-27 SwissSign AG — SwissSign provided a structured incident report including how it discovered the issue, when it stopped issuance, customer notification and revocation timeline, problematic certificate details, and planned remediation checks.
3. 2018-08-31 Fastly representative — A participant referenced bug 1443731 and stated that SwissSign’s pre-issuance linting should catch this problem (ZLint).