Sectigo: "Some-State" in stateOrProvinceName

This case involves Sectigo's disclosure of a compliance issue related to certificates containing the placeholder value "Some-State" in the stateOrProvinceName field. The issue was identified after a report was made to Sectigo's problem reporting mailbox on May 11, 2019. Sectigo began revoking the affected certificates on May 14, 2019, and completed the revocation of all identified certificates by June 30, 2019. The CA acknowledged the oversight in not validating this field properly and has since implemented measures to prevent similar issues in the future, including the development of a new incident response playbook and a system to track incident-related revocations. The case has been resolved with all certificates revoked and corrective actions taken.

1. 2019-05-11 Initial report received regarding the use of 'Some-State' in certificates.
2. 2019-05-14 Sectigo began revoking identified certificates.
3. 2019-06-30 All identified certificates were revoked.

1. 2019-05-14 Fastly representative — Reported the issue regarding certificates containing 'Some-State'.
2. 2019-06-25 Alexcohn representative — Noted that three certificates had not yet been revoked.
3. 2019-06-30 Sectigo — Confirmed that the remaining three certificates were revoked.
4. 2020-01-24 Sectigo — Confirmed that all certificates reported in this incident were revoked.