DigiCert JOI issue: incorrect jurisdiction of incorporation data, revocations, and validation-system fixes

DigiCert opened this bug to disclose a jurisdiction of incorporation (JOI) problem affecting issued certificates. DigiCert said it first became aware of the issue on 2019-08-19 after receiving a batch of certificates with incorrect JOI information, including misspellings, locality data in the wrong field, and country/incorporation mismatches. The company said it would revoke the affected certificates, notify customers, and fix its validation and issuance systems so similar errors would be blocked going forward. Over the course of the thread, DigiCert reported multiple review passes, revocation waves, and follow-up scans of EV and OV certificates, along with additional controls and a new validation workbench. The bug was eventually marked resolved, and Mozilla indicated it would close the bug after DigiCert’s final review and revocation list were posted.

1. 2019-08-19 DigiCert became aware of certificates with incorrect JOI information.
2. 2019-08-31 DigiCert rolled out a new check and began invalidating bad validation snapshots.
3. 2019-09-06 DigiCert revoked the first batch of affected certificates.
4. 2020-06-25 DigiCert completed its OV review and revoked 423 certificates with address-related issues.
5. 2020-11-03 DigiCert posted a final list of revoked certificates and said it had remediated past issues.

1. 2019-08-23 DigiCert — DigiCert reported that it received certificates lacking proper JOI information and said it would revoke them and fix the underlying validation process.
2. 2019-08-28 DigiCert — DigiCert outlined a timeline for deploying a new check, invalidating stored snapshots, notifying customers, and revoking the mis-issued certificates.
3. 2019-08-31 DigiCert — DigiCert said it rolled out the change, ran the script against issued certificates, and found many false positives that would take longer to review.
4. 2019-09-06 DigiCert — DigiCert attached round 1 and round 2 certificate lists, described the review methodology, and said it was 94% through manual review.
5. 2019-09-17 DigiCert — DigiCert said it moved the address check from validation to issuance, planned another scan, and would revoke wave 3 certificates.
6. 2020-04-10 DigiCert — DigiCert described additional JOI-related issues, including incorrect country code, incorrect organization name, and an incorrect JOI registration number.
7. 2020-07-29 DigiCert — DigiCert said it had rolled out an MVP validation tool and was running it alongside the old workbench before full cut-over.
8. 2020-11-03 DigiCert — DigiCert posted the final revoked-cert list and said it believed the past issues were remediated.
9. 2020-11-09 Mozilla representative — Mozilla said it would close the bug on or about 2020-11-13 unless there were additional issues or questions.