QuoVadis: Incorrect EV businessCategory

This case is a Mozilla CA Program disclosure by QuoVadis about EV certificates that were issued with an incorrect businessCategory value (“Non-Commercial Entity”). QuoVadis states it became aware of the problem via a problem report received from Clint Wilson at DigiCert, who had received an email from Cynthia Revstrom about a certificate issued to the National Library of Scotland with possible incorrect use of “Non-Commercial Entity” in the businessCategory field. QuoVadis investigated and issued instructions to replace and revoke the affected certificates, later identifying additional certificates requiring revocation (including Batch 2 and a further third batch). QuoVadis also states it stopped issuing certificates resulting from the miscategorisation on 18 Oct 2019 and that it reviewed clients with the “Non-Commercial Entity” businessCategory for EV businessCategory. The bug thread indicates remediation was completed, with QuoVadis requesting closure after its EV Subject DN review primarily resulted in JOI corrections updated in another Bugzilla issue. The bug was ultimately closed per a later comment stating remediation of businessCategory was complete.

1. 2019-10-14 QuoVadis received a problem report from DigiCert about a possible EV businessCategory miscategorisation for a certificate issued to the National Library of Scotland.
2. 2019-10-15 QuoVadis investigated and instructed replacement and revocation of the initially identified certificate(s).
3. 2019-10-18 QuoVadis stopped issuing certificates resulting from the “Non-Commercial Entity” miscategorisation.
4. 2019-10-21 QuoVadis confirmed revocation of the initial National Library of Scotland certificate(s) and identified additional certificates for revocation.
5. 2019-10-22 QuoVadis confirmed revocation of all 20 National Library of Scotland certificates.
6. 2019-10-25 QuoVadis communicated the issue to affected customers.
7. 2019-10-30 QuoVadis completed revocation of the identified certificates.
8. 2019-12-27 QuoVadis requested closure, stating remediation was complete and pointing to JOI corrections in another bug.
9. 2020-01-22 The bug was closed after confirmation that businessCategory remediation was complete.

1. 2019-11-01 DigiCert — Stephen Davidson repeated the disclosure in this bug at the request of Ryan Sleevi and referenced the detailed disclosure in bug 1590171.
2. 2019-11-01 DigiCert — Davidson confirmed revocation of certificates identified in Batch 2 and described continued investigation and completion timing for additional batches.
3. 2019-11-14 DigiCert — Davidson provided background on QuoVadis’s Trustlink/PKI operations and described migration planning and adoption of DigiCert validation practices, including incident disclosure and revocation requirements.
4. 2019-12-02 DigiCert — Davidson stated QuoVadis was reviewing EV Subject DN settings including businessCategory and would provide an update by Dec 15.
5. 2019-12-27 DigiCert — Davidson requested closure, stating the EV Subject DN review primarily resulted in JOI corrections updated at bug 1589047.
6. 2020-01-22 Fastly representative — W. Thayer closed the bug per the statement that remediation of businessCategory was complete.