SwissSign: Misissuance with misspellings in Location for a number of Certificates

SwissSign AG reported a misissuance incident involving 47 SSL and 113 S/MIME certificates that contained misspellings in the location fields. The issue was discovered during an audit on November 14, 2019, leading to the revocation of the affected certificates starting December 11, 2019. SwissSign implemented a manual process to prevent future misissuance and has since developed automated checks based on official standards. The incident report was filed on February 5, 2020, after the critical certificates were revoked. The CA acknowledged delays in reporting and revocation, which were attributed to the nature of the certificates' use in critical infrastructure. The case has been resolved with all identified certificates revoked.

1. 2019-11-14 Discovery of misissued certificates during an audit.
2. 2019-12-11 Acknowledgment of misissue and initiation of revocation.
3. 2020-02-05 Incident report filed with Mozilla.
4. 2020-07-22 Implementation of new automated checks.
5. 2020-08-10 All affected certificates revoked.

1. 2020-02-05 SwissSign AG — Reported misissuance of certificates with misspellings.
2. 2020-02-05 Mozilla representative — Questioned the delay in filing the incident report.
3. 2020-02-05 Community commenter — Emphasized the need for timely reporting and revocation.
4. 2020-07-28 SwissSign AG — Confirmed implementation of automated checks.
5. 2020-08-11 SwissSign AG — Announced revocation of all affected certificates.