Asseco DS / Certum: EV Certificates issued with wrong Business Category

Certum (Asseco Data Systems S.A.) reported that it was notified by a third party that 11 EV SSL certificates identified the organization in the certificate as a “Non-Commercial Entity.” Certum reviewed EV certificates containing the “Non-Commercial Entity” business category and found additional affected certificates, stating that it ultimately identified 12 problematic certificates issued between 2018-06-08 and 2019-11-21. Certum said it stopped issuing EV TLS/SSL certificates with the “Non-Commercial Entity” business category after confirming the scope, and it trained its Validation Specialists on when that category can be used. Certum also updated its procedures/documentation to align with the EV Guidelines business category requirements and stated that all problematic certificates have been revoked. The thread notes that Certum was waiting for client approval to revoke at the time of the initial report, but later comments indicate the remediations were complete and the incorrect procedure contents were updated by 2019-12-06. The bug was resolved as FIXED.

1. 2019-11-25 Certum was notified by a third party that EV SSL certificates used the “Non-Commercial Entity” business category.
2. 2019-11-28 Certum informed customers they needed to submit a new request and revoke problematic certificates.
3. 2019-12-06 Certum updated its EV business category procedure/documentation to meet current EV Guidelines.
4. 2019-12-09 Certum stated all problematic certificates had been revoked and remediations were complete.

1. 2019-11-29 Assecods representative — Opened the bug describing a third-party notification about EV certificates with the wrong “Non-Commercial Entity” business category and outlining review, training, and revocation steps.
2. 2019-12-02 Community commenter — Asked for deeper systemic root-cause analysis beyond “misunderstanding,” including what other misunderstandings might exist and how processes would be re-evaluated.
3. 2019-12-09 Assecods representative — Said an additional review of EV issuance procedures found no further misunderstandings, that standard reviews occur annually, and that documentation/procedure contents were updated on 2019-12-06; also stated problematic certificates were already revoked.
4. 2019-12-09 Fastly representative — Commented that questions were answered and remediations were complete.