Sectigo: invalid subject:organizationalUnitName on DV certificates

This case involves Sectigo's discovery of a compliance issue regarding the use of the organizationalUnitName (OU) field in Domain Validated (DV) certificates. Sectigo acknowledged that many DV certificates included OU fields with values that did not correspond to validated subject information, which is a violation of the Baseline Requirements. In response, Sectigo committed to ceasing the practice of including such values and implemented changes to their certificate issuance process by December 15, 2019. The issue was resolved with the implementation of these changes, and Sectigo has since stopped issuing DV certificates with problematic OU fields.

1. 2019-11-01 Sectigo became aware of the issue through a discussion in the Mozilla security policy mailing list.
2. 2019-12-15 Sectigo implemented changes to stop including non-validated OU fields in DV certificates.

1. 2019-11-04 Thisisntrocket representative — Opened the bug reporting the issue with OU fields in Sectigo's DV certificates.
2. 2019-11-13 Sectigo — Acknowledged the report and outlined Sectigo's understanding of the relevant Baseline Requirements.
3. 2020-01-22 Sectigo — Confirmed that Sectigo had implemented the planned changes to remove additional OU fields.
4. 2020-09-10 Mozilla representative — Indicated that the bug could be closed as Sectigo had ceased issuing problematic certificates.