D-TRUST: EV certificates with incorrectly used Subject Business Category value
DigiCert notified D-TRUST (via Mozilla’s Problem Reporting Mechanism) that D-TRUST had issued EV certificates with an incorrectly used Subject Business Category value of "Non-Commercial Entity". D-TRUST investigated and reported that 4 EV certificates for 3 organizations were affected, with issuance dates ranging from 2018-03-01 to 2019-07-23. In response, D-TRUST suspended user accounts associated with the Subject Business Category value "Non-Commercial Entity" and initiated customer communication. D-TRUST stated the cause was an error in process documentation/requirement translation: during translation into German, "non-commercial" was misunderstood ("gemeinnützig" used incorrectly), leading the validation checklist to classify entities incorrectly and issue certificates with the wrong businessCategory entry. D-TRUST later adapted process documentation and trained the validation team, changed customer profiles, and released suspended user accounts so certificates could be obtained again via the affected customer profiles. D-TRUST revoked the affected certificates on 2019-11-29, 10:00 UTC and stated replacement certificates would be made available; it also revised validation guidelines and required management approval for use of the "Non-Commercial Entity" entry. A later comment indicated remediation was complete.
- DigiCert notified D-TRUST that EV certificates had been issued with an incorrectly used Subject Business Category value.
- D-TRUST began investigating and suspended user accounts tied to the incorrect Subject Business Category value.
- D-TRUST completed analysis/action plan, updated process documentation/training, and released suspended user accounts via updated customer profiles.
- D-TRUST revoked all affected certificates and planned replacement certificates for affected customers.
- A participant stated remediation was complete.
- Bdr representative — Reported that a third party (digiCert) notified D-TRUST on 2019-11-25 about EV certificates with an incorrectly used businessCategory entry, described the affected certificates, and stated D-TRUST suspended user accounts with Subject Business Category "Non-Commercial Entity" pending investigation.
- Bdr representative — Provided an updated timeline, explained the localization/translation misunderstanding behind the incorrect Subject Business Category value, stated the cause was fixed, and said affected certificates would be revoked on 2019-11-29, 10:00 UTC with replacement certificates to follow.
- Community commenter — Asked about additional steps to examine other translation issues in internal validation guidelines and noted management-level overrides as mitigation.
- Bdr representative — Confirmed revocation of all affected certificates on 2019-11-29, 10:00 UTC, stated no further inconsistencies were identified, and said a full revision of validation guidelines is planned with a focus on localization.
- Fastly representative — Commented that it appears all questions were answered and remediation is complete.