DigiCert: Failure to revoke invalid serialNumber EV certificates within 5 days

The case concerns DigiCert’s handling of two EV leaf certificates whose serialNumber values were reported as incorrect. An external reporter contacted DigiCert on 13 June 2020 to revoke the two certificates, citing that there was no organisation linked to the serialNumber value “BG” and referencing a misissuance report. DigiCert initially stated on 17 June 2020 that the certificates had not been misissued and that they would not be revoked. After further clarification and discussion, DigiCert later indicated that the certificates would be revoked, stating the revocation would occur 5 days after DigiCert received updated registration information from the registering authority on 21 June 2020 10:27 MDT, which DigiCert noted would surpass the 5-day mandated revocation timeline in section 4.9.1.1. The reporter subsequently confirmed on 20 June 2020 that the issue appeared resolved after DigiCert clarified that “BG” was assigned as the registration number by the Office of the Superintendent of Financial Institutions. The bug was resolved as INVALID.

1. 2020-06-13 An external reporter notified DigiCert to revoke two EV leaf certificates due to an alleged serialNumber discrepancy.
2. 2020-06-17 DigiCert stated it was not planning to revoke the certificates.
3. 2020-06-21 DigiCert received updated registration information from the registering authority (as stated in the thread).
4. 2020-06-20 The reporter confirmed the issue appeared resolved after DigiCert clarified the meaning of “BG”.

1. 2020-06-18 Fozzie representative — Reported that DigiCert failed to revoke two invalid serialNumber EV certificates within 5 days and provided a timeline including DigiCert’s initial refusal to revoke and later statement about revocation after receiving new registration information.
2. 2020-06-19 DigiCert — Said DigiCert was not planning revocation because the certificates were properly issued and that the earlier claim about receiving a new incorporation number was incorrect.
3. 2020-06-19 Fozzie representative — Asked for clarification on what documents DigiCert had that linked “BG” to the company.
4. 2020-06-20 DigiCert — Clarified that “BG” was assigned as the registration number by the Office of the Superintendent of Financial Institutions.
5. 2020-06-20 Fozzie representative — Acknowledged the clarification and stated the issue seemed resolved.