← DigiCert cases
Bugzilla #1576283
Certificate Misissuance
QuoVadis: N/A in EV serialNumber field
RESOLVED
FIXED
DigiCert
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
QuoVadis was notified by a security researcher about an issue involving 32 certificates that had 'N/A' in the EV serialNumber field. The CA acknowledged the issue and communicated with the affected customer to stagger the revocation of the certificates over a week. By August 23, 2019, all problematic certificates were revoked. QuoVadis has since implemented filters to prevent similar issues in the future. The bug was resolved with the implementation of these changes on January 13, 2020.
Chronology
- QuoVadis received notification from a security researcher.
- All 32 certificates with the issue were revoked.
- Filters to prevent similar issues were implemented.
Thread Activity
- DigiCert — QuoVadis was notified by a security researcher about the issue.
- DigiCert — Asked if anything else is required to close the bug.
- Fastly representative — Inquired about technical controls to eliminate similar errors.
- DigiCert — Confirmed implementation of picklists and rules to prevent null entries.
- DigiCert — Requested to close the bug after implementing the changes.
Participants
DigiCert
Fastly representative
Community commenter
External References
Similar Local Cases
QuoVadis / PKIoverheid: incorrect OCSP response for precertificate
QuoVadis: Incorrect EV jurisdiction of incorporation information
Disig: Non-BR-Compliant Certificate Issuance
CFCA: Wrong SerialNumber encoding
Telia: Misissued certificate - invalid dnsName
SwissSign: Misissuance of Intermediate Certificates because of incorrect organizationIdentifier
Sectigo: EV SSL Certificates with incorrect subject details.
Entrust: EV Certificates Issued with Business Category "Non-Commercial" when it should have been set to "Private Organization"