DigiCert underscore certificate incident for Verizon-related certificates

This case concerns DigiCert’s disclosure of an underscore-character certificate incident affecting Verizon-related certificates. DigiCert said it first became aware of the issue through CA/Browser Forum discussions and later confirmed that an incident had occurred. The company explained that it stopped issuing underscore characters, notified customers, gathered the affected certificate inventory, and worked with customers to plan replacement and revocation timing. DigiCert stated that the remaining underscore certificates were revoked on 2019-03-01. A later comment said the remediation was complete and all questions had been answered.

1. 2018-09-05 Browsers raised the underscore issue in the CA/Browser Forum.
2. 2018-10-01 DigiCert ceased issuance of underscore characters.
3. 2018-12-04 DigiCert provided customers a list of impacted certificates.
4. 2019-03-01 The remaining underscore certificates were revoked.

1. 2018-12-27 DigiCert — Jeremy Rowley posted the incident timeline, described when DigiCert learned of the issue, and listed the actions taken in response.
2. 2019-01-14 DigiCert — Brenda Bernal clarified that the second certificate list was additional scope for the wireless business and said DigiCert was requesting time until 2019-03-01 to replace and test the affected certificates.
3. 2019-01-18 DigiCert — Brenda Bernal confirmed that an incident had occurred, said the details were accurate to the best of DigiCert’s knowledge, and repeated that the planned revocation date was 2019-03-01.
4. 2019-03-03 DigiCert — Brenda Bernal reported that the remaining underscore certificates were revoked as of 2019-03-01.
5. 2019-03-03 Fastly representative — W. Thayer said all questions appeared answered and remediation had been completed.