Consorci AOC: Misissued EV certificates included subject:organizationIdentifier attribute (CABForum EV Guidelines 1.6.9 non-compliance)

Consorci AOC reported that, during its quarterly internal audits, it detected a compliance issue affecting EV SSL certificates issued under the EV Guidelines version 1.6.9. The issue was that 19 certificates issued under the EV Guidelines (within the validity period of version 1.6.9) incorrectly contained the subject:organizationIdentifier attribute. Consorci AOC stated that it identified the applicable EV Guidelines versions and affected certificates on 2019-10-11, planned revocation on 2019-10-16, and publicly notified the issue to Bugzilla on 2019-10-23. The CA said the scope was limited to certificates issued between April 16, 2019 and June 20, 2019, and that the 19 affected certificates were issued between April 24, 2019 and June 18, 2019. Consorci AOC also stated it would cease issuing new SSL certificates by the end of 2019 and would carry out revocation gradually, with renewal of affected certificates planned to be completed by mid-November. In the thread, Consorci AOC later confirmed that the 19 affected certificates have been revoked, and a third party indicated that remediation was complete.

1. 2019-10-09 Consorci AOC’s Q2 2019 quarterly internal audit detected that 19 EV SSL certificates incorrectly contained the subject:organizationIdentifier attribute.
2. 2019-10-11 Consorci AOC identified the applicable EV Guidelines versions and the affected certificates.
3. 2019-10-16 Consorci AOC planned revocation of the affected certificates.
4. 2019-10-23 Consorci AOC publicly notified the issue to Bugzilla through this incident report.
5. 2019-11-27 Consorci AOC revoked the 19 affected certificates.

1. 2019-10-23 Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) — Reported that 19 EV SSL certificates issued under EV Guidelines 1.6.9 incorrectly included subject:organizationIdentifier, and provided a timeline and CT links.
2. 2019-11-27 Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) — Confirmed that the 19 affected certificates have been revoked.
3. 2019-12-27 Fastly representative — Stated that it appears all questions were answered and remediation is complete.