Camerfirma: EV certificates issued with incorrect business category values

Camerfirma reported that it had issued EV certificates with incorrect business category values. The CA said it became aware of the issue on November 25, 2019 after a communication from a third party (Michael Lettona from Digicert), and it found 7 active certificates with the wrong business category. Camerfirma investigated, created substitute certificates, and coordinated with affected clients to revoke the problematic certificates; it stated that the value was corrected for new certificates going forward. The CA initially reported that 7 certificates (issued between 2018-03-23 and 2019-09-17) were affected, and it later reported additional miscategorized certificates for the Govern of Andorra, including 122 certificates with “Business entity” instead of “Government Entity.” Camerfirma stated that all misissued certificates were revoked by Dec 17, 2019 and that it had not detected more cases during its review. It also described prevention steps, including distributing a guideline to RA operators, internal training, updating its manual, and adding related test questions; a Fastly participant later stated that it appeared remediation was complete. The bug is marked RESOLVED with resolution FIXED.

1. 2019-11-25 Camerfirma began examining EV certificates after receiving a third-party communication about incorrect business category values.
2. 2019-11-26 Camerfirma’s legal department prepared conclusions and the CA contacted affected clients to plan revocation and substitution.
3. 2019-11-29 Camerfirma revoked the initially identified misissued certificates.
4. 2019-12-13 Camerfirma reported additional miscategorized certificates for the Govern of Andorra and provided an updated list.
5. 2019-12-17 Camerfirma revoked the last misissued certificate.
6. 2019-12-27 Camerfirma described prevention measures to avoid similar errors in the future.
7. 2020-01-21 A participant indicated it appeared remediation was complete.

1. 2019-11-28 AC Camerfirma, S.A. — Ana Lopes described how Camerfirma became aware of the issue, identified 7 active certificates with wrong business category values, and outlined the CA’s investigation and planned revocations/substitutions.
2. 2019-12-02 AC Camerfirma, S.A. — Ana Lopes stated that the certificates with the wrong business category detected were revoked on Nov 29 and that the CA continued reviewing for other possible cases.
3. 2019-12-05 AC Camerfirma, S.A. — Martin Ja reported that the CA finished investigating the initially targeted category and had not detected more wrong cases for “Non comercial entity,” while continuing to review other categories.
4. 2019-12-13 AC Camerfirma, S.A. — Martin Ja reported that 122 certificates of the Govern of Andorra had a wrong category (“Business entity” instead of “Government Entity”) and described revocation/substitution progress.
5. 2019-12-18 AC Camerfirma, S.A. — Ana Lopes stated that all misissued certificates were revoked (last revoked Dec 17) and corrected the date of when specific instructions were provided to RA operators.
6. 2019-12-24 Fastly representative — Wayne Thayer asked what had been done to prevent similar problems from happening in the future.
7. 2019-12-27 AC Camerfirma, S.A. — Ana Lopes listed prevention actions: a guideline distributed to RA operators, internal training, an updated manual, and updates to the new-operator training course and tests.
8. 2020-01-21 Fastly representative — Wayne Thayer stated that it appeared all questions had been answered and remediation was complete.