SwissSign: Error in OrganisationIdentifier in signature/seal certificate

SwissSign reported that an internal review detected an unusual OrganisationIdentifier for an Austrian electronic signature/seal certificate. The issue was identified in the internal review cycle and was reported to SwissSign’s compliance function for evaluation. SwissSign determined the problem was a misissuance caused by a formatting error: a space was added to the organisationIdentifier (the expected structure was “NTRAT-<Firmenbuchnummer>”, sometimes with a trailing letter, but the customer-provided value included a space after the hyphen). SwissSign ordered revocation and coordinated with TÜV Austria (SwissSign’s auditor) and the customer, and it published an incident report in mozilla.dev.security.policy and this Bugzilla ticket. SwissSign stated that it completed the listed steps, checked all seals from EU customers with no additional findings, revoked the affected certificate, and updated its knowledge database for future products. The ticket was requested to be closed, and a later comment indicated remediation appeared completed. The bug is resolved as FIXED.

1. 2019-03-29 SwissSign’s internal employee reported an unusual OrganisationIdentifier in an Austrian signature/seal certificate during the internal review cycle.
2. 2019-04-01 SwissSign compliance double-checked the reported certificate and informed TÜV Austria of a possible noncompliance.
3. 2019-04-02 SwissSign confirmed the misissuance due to the organisationIdentifier form factor, documented the incident, and ordered revocation.
4. 2019-04-05 SwissSign reported completion of remediation steps, including revocation and follow-up checks across EU-customer seals.

1. 2019-04-02 SwissSign AG — Provided a detailed incident timeline and explanation for the OrganisationIdentifier formatting error and stated that revocation was ordered.
2. 2019-04-02 SwissSign AG — Shared the link to the mozilla.dev.security.policy posting for the incident report.
3. 2019-04-05 SwissSign AG — Updated that all steps were completed, EU-customer seals were checked with no additional findings, the certificate was revoked, and requested closure of the ticket.
4. 2019-04-08 Community commenter — Asked what checks SwissSign performs for Swiss entities and whether they are technical or manual.
5. 2019-04-09 SwissSign AG — Answered that seal checks are manual with dual control and listed the Swiss-entity organisationIdentifier checks.
6. 2019-04-25 Fastly representative — Commented that remediation appears to be completed.