DigiCert: IP address in dnsName (invalid dnsNames containing IP addresses)

The bug reports that DigiCert issued certificates with invalid dnsNames containing IP addresses. The reporter said DigiCert stopped issuing these invalid certificates in 2017, but the certificates were not revoked and were not accompanied by an incident report or explanation; they were later identified via CT/zlint queries. After being notified on 2019-01-29, DigiCert confirmed it was investigating and then revoked the affected certificates over the next few days. DigiCert’s incident report states that it was notified via a problem report on r**********e@digicert.com on 2019-01-29 and that the revocation plan was put in motion by 2019-01-30, with customer notifications and a revocation deadline of 2019-02-01 17:00 MT. The report also states that DigiCert had implemented a system block in April 2016 to not allow IP addresses in DNS SANs, but did not sweep existing certificates with that condition to enact revocation. By 2019-02-06, DigiCert provided additional certificate revocation details, and a later comment indicated remediation was complete. The bug is marked RESOLVED with resolution FIXED.

1. 2019-01-29 DigiCert was notified about certificates with invalid dnsNames containing IP addresses and acknowledged the report the same day.
2. 2019-01-30 DigiCert began investigation and started actions including identifying affected certificates and planning customer communications.
3. 2019-02-01 DigiCert’s customer notification deadline for revocation was set for this date/time.
4. 2019-02-06 DigiCert reported additional certificates revoked as part of the remediation.
5. 2019-05-17 A participant stated that remediation was complete.

1. 2019-02-03 Titanous representative — Reported that DigiCert issued certificates with invalid dnsNames containing IP addresses, noted they were not revoked when issuance stopped, and said DigiCert confirmed it was investigating; stated the certificates were revoked over the next few days and provided multiple crt.sh/zlint links.
2. 2019-02-04 DigiCert — Posted an incident report describing how DigiCert and CyberTrust Japan became aware of the issue, timelines of investigation and customer communications, stated issuance had stopped, and provided certificate details/links.
3. 2019-02-06 DigiCert — Provided nine additional certificates that were revoked by DigiCert as of this date with crt.sh links.
4. 2019-05-02 DigiCert — Asked whether further update was needed for resolution.
5. 2019-05-17 Fastly representative — Commented that remediation is complete.