Buypass: Illegal Business Category in a PSD2 QWAC

RESOLVED FIXED Buypass

This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update. Always refer to the official Bugzilla thread as the authoritative source. If you spot an inaccuracy, let me know via the contact form.

AI Summary

Buypass reported an incident involving a PSD2 Qualified Web Authentication Certificate (QWAC) that was issued with an incorrect Subject Business Category value set to 'UN' instead of 'Private Organization'. The CA discovered the issue immediately after issuance on April 21, 2020, and promptly revoked the certificate, replacing it with a correct one. Buypass ceased issuing all certificates with Business Categories and initiated an investigation into the cause. They implemented stricter controls to prevent similar issues in the future, including a bug fix in their systems. The case was resolved with the implementation of these corrective measures.

Model: gpt-4o-mini Generated: 2026-06-13 21:23 UTC Revised: 2026-06-16 18:18 UTC Confidence: 0.85 24 comments

Chronology

2020-04-21 Buypass issued a PSD2 QWAC with an illegal Subject Business Category value.
2020-04-21 The certificate was revoked and replaced with a correct certificate.
2021-06-29 Buypass completed major changes to their systems and controls.

Thread Activity

2020-04-23 Buypass — Buypass reported the incident and outlined the timeline of actions taken.
2020-05-22 Mozilla representative — Inquired about the system's prevention of issuing certificates with a business category of 'UN'.
2021-06-29 Buypass — Confirmed that the major part of changes within their systems was completed and suggested closing the bug.

Participants

Buypass Mozilla representative Community commenter

External References

Original Bugzilla Case crt.sh

Similar Local Cases

#1626078 RESOLVED Certificate Misissuance Self Reported Incident Opened 2020-03-30 · Closed 2026-06-10 · 100% similar

Buypass: Missing NCA identifier in cabfOrganizationIdentifier in PSD2 QWACs

AI Summary CA Owner

#1539307 RESOLVED Self Reported Incident Opened 2019-03-27 · Closed 2023-02-22 · 96% similar

Buypass: Insufficient Serial Number Entropy

AI Summary CA Owner

#1872371 RESOLVED Self Reported Incident Opened 2023-12-29 · Closed 2024-08-07 · 94% similar

Buypass: Using an external DNS Resolver for DNS lookups

AI Summary CA Owner

#1716123 RESOLVED Ca Certificate Compliance Certificate Misissuance Self Reported Incident Opened 2021-06-12 · Closed 2024-05-25 · 90% similar

e-commerce monitoring GmbH: CN domain not in SAN

AI Summary CA Owner

#1707073 RESOLVED Certificate Misissuance Self Reported Incident Opened 2021-04-22 · Closed 2023-02-22 · 89% similar

GlobalSign: Invalid countryName

AI Summary CA Owner

#1708834 RESOLVED Certificate Misissuance Self Reported Incident Opened 2021-04-30 · Closed 2023-02-22 · 89% similar

GlobalSign: Invalid stateOrProvinceName and locality pair

AI Summary CA Owner

#1705419 RESOLVED Certificate Misissuance Self Reported Incident Opened 2021-04-15 · Closed 2023-02-22 · 89% similar

Microsoft PKI Services: Underscore in SAN

AI Summary CA Owner

#1575022 RESOLVED Ca Certificate Compliance Certificate Misissuance Self Reported Incident Opened 2019-08-19 · Closed 2023-02-22 · 88% similar

Sectigo: EV SSL Certificates with incorrect subject details.

AI Summary CA Owner