GlobalSign: Wrong EV business category (Non-Commercial Entity vs Private Organization)

GlobalSign reported that it was notified by a third party that three EV SSL certificates identified the organization named in the certificate as a “Non-Commercial Entity.” GlobalSign stated that it reviewed certificates containing “Non-Commercial Entity” and determined that 3 of 65 certificates were non-compliant. GlobalSign decided to revoke the three certificates within five days per the Baseline Requirements and reported that it started and concluded its investigation within 24 hours. GlobalSign also said it reached out to certificate owners and communicated that the certificates needed to be replaced because revocation would follow the Baseline Requirements. In a later update, GlobalSign stated that the three certificates were revoked on 29 November 2019 and that additional training and testing had been rolled out. GlobalSign further described the cause as a breakdown in manual vetting for organizational details and said it added monitoring, monthly reviews, and updated training with testing of staff understanding.

1. 2019-11-25 GlobalSign was notified by a third party via the report abuse email address about three EV SSL certificates with an incorrect “Non-Commercial Entity” business category.
2. 2019-11-29 GlobalSign revoked the three identified non-compliant EV SSL certificates.

1. 2019-11-27 GlobalSign nv-sa — GlobalSign described how it became aware of the issue, its internal response timeline, its review findings (3 non-compliant certificates), and planned revocation and remediation steps, including links to crt.sh IDs.
2. 2019-11-27 GlobalSign nv-sa — GlobalSign added that a related issue had been missed in additional internal reviews and said it added compliance monitoring and scheduled monthly reviews.
3. 2019-11-29 GlobalSign nv-sa — GlobalSign reported that the three certificates were revoked on 29 November 2019 and that additional training and testing had been rolled out.
4. 2019-12-02 Community commenter — Ryan Sleevi asked for deeper systemic root-cause analysis and clarification on what other misunderstandings and process re-evaluations were planned.
5. 2020-01-06 GlobalSign nv-sa — GlobalSign responded that training was updated and staff were tested, and it explained the misunderstanding and low request volume as factors, plus planned additional internal investigations.
6. 2020-01-22 Community commenter — Ryan stated he had no further follow-up questions.
7. 2020-01-22 Fastly representative — W. Thayer indicated it appeared all questions were answered and remediation was complete.