Sectigo: invalid dnsName

This case concerns a certificate issued by a Sectigo sub-CA that contained an invalid dnsName value (`DNS=advisors.intel.com`). The issue was reported to Sectigo via its abuse reporting email address on 25-JAN-19, referencing a crt.sh/zlint entry for the certificate. Sectigo passed the report to the operator of the Name-constrained sub-CA that issued the end-entity certificate, and the operator reported that the certificate had been revoked the same day. Sectigo stated it stopped issuing certificates with the problem and that the Name-constrained sub-CA that issued the certificates had ceased issuing. Sectigo provided details that four certificates with the problem were detected, with issuance dates ranging from 11-JUL-16 to 19-May-17, and that three had been previously revoked for other reasons and later expired. Sectigo attributed the mistake to human error at the sub-CA operator (pasting a literal value including the `DNS=` prefix) and to a systems failing that allowed the incorrect value to be signed. As remediation, Sectigo said it introduced a policy requiring automated lint checking of tbsCertificates before signing, and it later confirmed that it lint-checked other currently valid certificates issued by the same sub-CA with no lint errors. The thread indicates the questions were answered and remediation was complete, and the bug was resolved as FIXED.

1. 2016-07-11 A certificate with the invalid dnsName issue was issued by the Name-constrained sub-CA.
2. 2017-05-19 The last certificate with the invalid dnsName issue was issued by the Name-constrained sub-CA.
3. 2019-01-25 Sectigo received a report about a certificate with an invalid dnsName and the issuing sub-CA operator reported revocation the same day.
4. 2019-02-21 Sectigo provided additional responses, including confirmation that other currently valid certificates were lint-checked.
5. 2019-08-03 A reviewer stated it appeared all questions were answered and remediation was complete.

1. 2019-02-02 Titanous representative — Reported that a Sectigo sub-CA issued a certificate with an invalid dnsName (`DNS=advisors.intel.com`), linked to crt.sh/zlint, and stated the certificate was revoked the same day after reporting.
2. 2019-02-02 Fastly representative — Asked Robin to provide an incident report per Mozilla guidance.
3. 2019-02-21 Sectigo — Submitted a detailed incident response including how Sectigo became aware, a timeline of actions, confirmation that issuing stopped, certificate details, root cause, and remediation steps (automated lint checking before signing).
4. 2019-02-21 Titanous representative — Asked whether Sectigo linted currently valid certificates issued by the sub-CA for other invalid dnsNames.
5. 2019-07-05 Sectigo — Confirmed that Sectigo lint-checked all other currently valid certificates issued by the sub-CA and found no lint errors.
6. 2019-08-03 Fastly representative — Stated it appeared all questions had been answered and remediation was complete.