← Sectigo cases
Bugzilla #1575022
Ca Certificate Compliance
Certificate Misissuance
Self Reported Incident
Sectigo: EV SSL Certificates with incorrect subject details.
RESOLVED
FIXED
Sectigo
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Sectigo reported a compliance issue involving EV SSL certificates that contained incorrect subject details, specifically related to the Jurisdiction of Incorporation (JoI) and subject:serialNumber fields. The CA became aware of the problem through multiple user reports received between August 16 and August 27, 2019. In response, Sectigo initiated the revocation of affected certificates and implemented a series of corrective actions, including deploying code to prevent the issuance of certificates with invalid data. The issue was resolved with the implementation of a JoI policy checker and other validation improvements, and the bug was marked as fixed on February 22, 2023.
Chronology
- First problem report received regarding incorrect subject details.
- Sectigo committed to providing regular updates on the incident.
- Bug marked as resolved after corrective actions were implemented.
Thread Activity
- Sectigo — Sectigo acknowledged the issue and began revoking affected certificates.
- Fastly representative — Requested a remediation timeline from Sectigo.
- Sectigo — Published a list of identified certificates with JoI mismatches.
- Sectigo — Bug marked as fixed after implementing necessary changes.
Participants
Sectigo
Fastly representative
DigiCert
Community commenter
Mozilla representative
External References
Similar Local Cases
Sectigo: Failure to block disallowed LDH labels in domain names
Sectigo: Incorrect JOI for federal credit unions
Sectigo: Use of forbidden subjectPublicKeyInfo algorithm
Sectigo: Failure to provide timely incident reports
Sectigo: invalid subject:organizationalUnitName on DV certificates
Sectigo: Non-revocation of certificates with subject:organizationalUnitName in DV certificates
Sectigo: Lack of input validation in stateOrProvinceName
Sectigo: CPR response issues