Sectigo disclosure of invalid stateOrProvinceName values in EV and OV certificates

Sectigo disclosed that it had issued certificates with invalid values in the Subject:stateOrProvinceName (ST) field, first in EV certificates and later in OV certificates. The report was triggered by an external bug filed by George Fozzie, who listed multiple affected certificates and noted that Sectigo said they were queued for revocation. Sectigo said it investigated the issue, identified root causes in its issuance process, and began posting batches of affected certificates to misissued.com for disclosure and revocation. The thread also records that some certificates were revoked late, with Sectigo explaining that revocation and notification were being handled largely manually and that large OV batches made it difficult to meet the five-day BR window. Sectigo later said it had found and revoked all affected certificates, put a whitelist of allowed ST values in place, and considered the issue resolved. The bug was ultimately closed as a duplicate of bug 1710243.

1. 2020-06-14 External report identified multiple Sectigo EV certificates with invalid stateOrProvinceName values.
2. 2020-06-22 Sectigo said the issuance issue had been fixed and that delayed revocation for one certificate would be explained.
3. 2020-09-17 Sectigo said it had applied a code change for OV certificates to allow only approved ST values.
4. 2020-10-15 Sectigo posted the first confirmed batch of OV certificates with bad ST fields.
5. 2021-01-05 Sectigo said all certificates with invalid ST fields had been revoked or expired.
6. 2021-02-08 Sectigo said the issue was fully resolved and asked for the bug to be closed.
7. 2021-05-11 The bug was reopened briefly for additional state-field reports and then closed as a duplicate of bug 1710243.

1. 2020-06-14 Fozzie representative — Reported many Sectigo EV certificates with incorrect stateOrProvinceName values and said the certificates were queued for revocation.
2. 2020-06-15 Sectigo — Acknowledged the report and said Sectigo was identifying the factors that allowed the certificates to be issued.
3. 2020-06-22 Sectigo — Said the issuance issue had been fixed and that the delayed revocation of one certificate would be explained.
4. 2020-06-24 Sectigo — Said Sectigo was comparing issued EV certificates against country/state data and would revoke additional misissued certificates.
5. 2020-07-03 Sectigo — Said a certificate discussed in the thread had been revoked.
6. 2020-08-26 Sectigo — Said Sectigo believed it had found and revoked all EV certificates with invalid ST values and described two root causes.
7. 2020-09-17 Sectigo — Said Sectigo had applied the learned filtering to OV certificates and found a much larger population needing review.
8. 2020-10-28 Sectigo — Posted an incident report describing discovery, timeline, the stop in issuance changes, and the affected OV batches.
9. 2021-01-05 Sectigo — Said all certificates with invalid ST fields were revoked or expired as of 2020-12-31.
10. 2021-02-08 Sectigo — Said the issue was resolved and asked for the bug to be closed.
11. 2021-05-11 Sectigo — Said bug 1710243 was a duplicate of this bug and asked to reopen this bug for related state-field reports.
12. 2021-05-11 Mozilla representative — Marked this bug as a duplicate of bug 1710243 and closed it.