Izenpe incident report for multiple invalid EV certificates and revocation/remediation actions

This case is Izenpe’s incident disclosure about multiple invalid EV certificates that were issued under its certificate profiles. Mozilla opened the bug after detecting the problem and asked Izenpe to provide an incident report, affected-certificate analysis, and remediation steps. Izenpe said it stopped issuing EV certificates while investigating, identified two problems in its profiles, and later revoked the affected certificates. The thread records that 14 certificates were affected by the qcStatement-2 / missing semantics identifier issue and 133 certificates involved the OrganizationIdentifier issue, with all misissued certificates later reported as revoked. Izenpe also described follow-up remediation work, including profile changes, customer communication improvements, automation, and a new web application integrated with its PKI system. The bug was later marked RESOLVED/FIXED.

1. 2019-06-17 Mozilla detected multiple invalid EV certificates issued by Izenpe and requested an incident report.
2. 2019-06-17 Izenpe stopped issuing EV certificates while it analyzed the problem.
3. 2019-06-20 Izenpe reported two issue sets: 14 certificates with qcStatement-2 / missing semantics identifier and 6 certificates with an invalid subject attribute under Ballot SC16.
4. 2019-07-01 Izenpe reported 133 certificates with OID 2.5.4.97 that would need replacement.
5. 2019-07-03 Izenpe began immediate revocation of the affected certificates.
6. 2020-11-04 Izenpe reported that its new applications and automated validation system were in production.

1. 2019-06-17 Community commenter — Ryan Sleevi reported multiple invalid EV certificates and asked Izenpe for an incident report and remediation details.
2. 2019-06-17 Izenpe S.A. — Oscar Garcia said Izenpe had stopped EV issuance, was identifying affected certificates, and would notify customers to revoke them.
3. 2019-06-20 Izenpe S.A. — Izenpe described its EV profiles, said it had found two issues, and provided counts and issuance dates for the affected certificates.
4. 2019-06-21 Izenpe S.A. — Izenpe said all misissued certificates listed so far had already been revoked.
5. 2019-07-01 Izenpe S.A. — Izenpe said 133 certificates containing OID 2.5.4.97 would need replacement and discussed revocation and reissuance timing.
6. 2019-07-03 Izenpe S.A. — Izenpe said it had decided to proceed with immediate revocation and had already revoked the first certificates.
7. 2019-07-16 Izenpe S.A. — Izenpe reported that all but one certificate had been revoked by the proposed date and listed remediation measures to reduce future delays.
8. 2020-11-04 Izenpe S.A. — Izenpe said its new customer and operator applications were in production and that validations were now automated.