Amazon Trust Services: No Space In Private Organization

Amazon Trust Services reported that it had issued five EV sample certificates with an incorrectly formatted businessCategory value. The issue was that the certificates contained “PrivateOrganization” instead of “Private Organization” (missing the space). Corey Bonnell brought the problem to Amazon’s policy management and legal team on July 18, 2019, and Amazon began an investigation the same day. Amazon stated it corrected the certificate templates on July 19, 2019 and completed a multi-person review of all fields in the certificate template on July 24, 2019. Amazon also moved the planned revocation and renewal to July 29, 2019, and reported that the five certificates were revoked on July 29, 2019 between 23:46:27 and 23:48:24 UTC. A later comment stated that remediation was complete.

1. 2019-01-28 Amazon Trust Services issued five EV sample certificates with businessCategory formatted as “PrivateOrganization” (missing the space).
2. 2019-07-18 Corey Bonnell reported to Amazon’s policy management and legal team that five EV certificates had an incorrectly formatted businessCategory entry.
3. 2019-07-19 Amazon corrected the certificate templates to add the missing space in businessCategory.
4. 2019-07-24 Amazon completed a multi-person review of all fields in the certificate template.
5. 2019-07-29 Amazon revoked the five affected sample certificates.

1. 2019-07-26 DigiCert — Dave Blunt described the issue (businessCategory missing a space), the investigation timeline, template correction and review dates, and stated the five sample certificates were revoked after moving the revocation/renewal to July 29, 2019.
2. 2019-07-26 Community commenter — Corey Bonnell said the email address used to report the issue was listed in Amazon’s CPS and asked about which address should be used for non-subscriber problem reports.
3. 2019-07-29 Community commenter — Ryan Sleevi asked for more technical context on how template review worked, and whether CP/CPS language might be out of date, referencing related bugs and incident handling questions.
4. 2019-07-31 DigiCert — Dave Blunt reported the exact revocation window on July 29, 2019 and explained how templating changes and review scope led to the missed space, plus plans to clarify CPS/CP reporting addresses.
5. 2019-08-10 Fastly representative — W. Thayer stated it appeared all questions had been answered and remediation was complete.