Sectigo: EV SSL Certificates with incorrect businessCategory

Sectigo reported that it received an external report alleging that some EV SSL certificates had an incorrect subject:businessCategory value of "Non-Commercial Entity" even though the EV Guidelines specify that this category should be for intergovernmental organizations (section 8.5.5). Sectigo stated that its initial determination was that the report was correct for four specific certificates, and that it would work with subscribers to revoke the affected certificates and issue replacements with correct subject details. Sectigo said it examined its body of previous EV issuance to determine whether other examples existed, and it also stated that it had stopped issuing certificates with this problem. In the thread, Sectigo described that some validation staff had a mistaken understanding of the "Non-Commercial entity" requirement and that its 2nd approval validators were not as effective as they should have been prior to corrective steps discussed in Bug 1575022. Sectigo later provided a list of 109 EV SSL certificates it said were issued with the incorrect subject:businessCategory and shared links for the certificate list and a revocation checker batch. The bug was closed after Mozilla indicated that it appeared all questions had been answered, and Sectigo reported publishing a list of Non Commercial Entities via a shared document link.

1. 2019-10-22 Sectigo received a report alleging EV certificates were improperly issued with an incorrect subject:businessCategory value.
2. 2019-10-23 Sectigo advised subscribers that affected certificates should be replaced as they would be revoked and opened this bug.
3. 2019-11-01 Sectigo posted its incident response report in this bug.
4. 2019-11-04 Sectigo provided a list of EV SSL certificates it said were issued with the incorrect subject:businessCategory.
5. 2020-02-09 Sectigo aimed to publish a list of Non Commercial Entities by this date.
6. 2020-06-03 Sectigo published its Non Commercial Entity list via a shared document link.
7. 2020-06-29 Mozilla closed the bug after indicating questions were answered.

1. 2019-10-23 Sectigo — Sectigo reported receiving an external incident report and stated its initial determination that four listed EV certificates were affected, with plans to revoke and replace them and to examine prior issuance.
2. 2019-11-01 Sectigo — Sectigo provided a detailed timeline and described steps taken, including stopping issuance of the problem and commencing examination of issued EV certificates with the incorrect businessCategory.
3. 2019-11-04 Sectigo — Sectigo shared a link to a spreadsheet listing 109 EV SSL certificates it said had the incorrect subject:businessCategory and referenced a revocation checker batch.
4. 2019-11-18 Sectigo — Sectigo stated no further actions were pending for this bug and said it was still tracking an activity to publish a list of Non Commercial entities without a target publication date.
5. 2019-12-27 Fastly representative — Fastly asked to keep the bug open to track the idea of publishing a list and requested an explanation or estimate if not practical.
6. 2019-12-27 Community commenter — Ryan Sleevi referenced that in Bug 1599484, Entrust indicated interest in publishing a list as well.
7. 2020-01-24 Sectigo — Sectigo stated it aimed to have the Non Commercial Entities list published by 9 February.
8. 2020-06-03 Sectigo — Sectigo provided a link to its published Non Commercial Entity list document.
9. 2020-06-29 Mozilla representative — Mozilla closed the bug, stating it appeared all questions had been answered.