DigiCert: & character in a printableString in ICA

DigiCert discovered a compliance issue involving three Intermediate Certificate Authorities (ICAs) that improperly encoded an '&' character in the organization name as a PrintableString instead of UTF8. This issue was identified during internal investigations following discussions on Mozilla forums regarding key ceremonies. DigiCert reported the mis-issuance to Wells Fargo on October 29, 2019, and subsequently revoked the affected certificates on November 1, 2019. The CA has since stopped issuing certificates with this encoding problem and is working on improving its linter for key ceremonies to prevent future occurrences. The resolution involved implementing zlint to check ICAs for issues pre-issuance, which has been successfully tested in recent key ceremonies.

1. 2019-10-29 DigiCert reported the mis-issuance of three ICAs to Wells Fargo.
2. 2019-11-01 DigiCert revoked the affected ICAs.

1. 2019-11-04 DigiCert — DigiCert reported the discovery of improper encoding in three ICAs during internal audits.
2. 2019-11-11 DigiCert — DigiCert is investigating the use of zlint to check ICAs for issues pre-issuance.
3. 2019-12-17 DigiCert — DigiCert implemented zlint in the key ceremony process, successfully identifying issues.
4. 2019-12-24 Fastly representative — All questions have been answered and remediation is complete.