DigiCert: Underscores - Citi

This case concerns DigiCert certificates containing underscore characters (“Underscores - Citi”) and the need to revoke certificates in response to browser concerns raised through the CA/Browser Forum. DigiCert stated that the issue was raised by browsers on September 5, 2018, and that CAB Forum discussions led DigiCert to believe the certificates would require revocation. DigiCert said it stopped issuing certificates with underscore characters on October 1, 2018, and notified customers about the browser concern. DigiCert also discussed a plan for revoking remaining certificates, including a planned extension to revoke the remaining certificates listed in scope, with the planned date corrected to 30-April-2019. Brenda Bernal confirmed an incident occurred and that the details were accurate to the best of DigiCert’s knowledge, and stated that periodic updates would be provided. The thread reports a final update that all remaining underscore certs for this customer were revoked as of 30-April-2019, and the bug is resolved as FIXED.

1. 2018-10-01 DigiCert ceased issuing certificates with underscore characters.
2. 2019-04-30 DigiCert revoked the remaining underscore certificates for the customer in scope.

1. 2019-01-03 DigiCert — Provided a timeline describing how DigiCert became aware of the underscore issue and the actions taken, including stopping issuance and planning revocation.
2. 2019-01-08 Community commenter — Asked about mitigation steps for tooling/channel-level changes and about how the revocation date (referenced as April 30) was selected.
3. 2019-01-08 DigiCert — Responded that DigiCert understood there was no exception/extension and that all CAs were expected to revoke on the required date.
4. 2019-01-11 DigiCert — Posted crt.sh links for certificates in scope.
5. 2019-01-17 Community commenter — Asked Jeremy to confirm whether an incident occurred and to ensure affected-certificate details were accurate.
6. 2019-01-18 DigiCert — Confirmed an incident occurred, said details were accurate to the best of DigiCert’s knowledge, and stated the planned revocation extension date was 30-April-2019 (correcting an earlier 2018 date).
7. 2019-05-01 DigiCert — Reported that all remaining underscore certs for this customer had been revoked as of 30-April-2019.