← Actalis cases
Bugzilla #1648997 Certificate Misissuance

Actalis: inaccurate value in stateOrProvinceName

RESOLVED FIXED Actalis
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update. Always refer to the official Bugzilla thread as the authoritative source. If you spot an inaccuracy, let me know via the contact form.
AI Summary

Actalis discovered an issue where SSL Server certificates incorrectly listed 'München' instead of 'Bayern' in the stateOrProvinceName field. The CA was alerted by a user on June 27, 2020, and began an investigation, confirming the error later that day. A total of 20 certificates were affected, and while most were revoked, one certificate was delayed at the customer's request. The root cause was identified as human error during the vetting process, and Actalis plans to integrate a third-party geographical database to prevent future occurrences. The issue was resolved, and the bug was marked as fixed.

Model: gpt-4o-mini Generated: 2026-06-13 21:22 UTC Revised: 2026-06-16 18:04 UTC Confidence: 0.85 11 comments
Chronology
  1. Actalis received a report about incorrect stateOrProvinceName values in SSL certificates.
  2. Actalis confirmed the error and began revocation of affected certificates.
  3. Actalis integrated a geographical database to improve vetting accuracy.
Thread Activity
  1. Staff representative — Actalis acknowledged the issue and began investigating the reported problem.
  2. Staff representative — Actalis identified human error as the root cause of the misissuance.
  3. Staff representative — Actalis confirmed the integration of the geographical database was completed.
Participants
Staff representative Fozzie representative Community commenter Mozilla representative
Similar Local Cases
#1717357 RESOLVED Certificate Misissuance Incident Opened 2021-06-20 · Closed 2023-02-22 · 100% similar
Actalis: Issuance of intermediates after 2020-08-20 that do not comply with Mozilla Policy and the Baseline Requirements
#1390974 RESOLVED Certificate Misissuance Self Reported Incident Opened 2017-08-16 · Closed 2023-02-22 · 97% similar
Actalis: Non-BR-Compliant Certificate Issuance
#1906690 RESOLVED Certificate Misissuance Opened 2024-07-08 · Closed 2025-03-18 · 95% similar
Actalis: CRL distribution point with ldap scheme
#1914419 RESOLVED Certificate Misissuance Opened 2024-08-22 · Closed 2025-02-04 · 95% similar
Actalis: Use of CRLReason Code in Certificate Revocation
#1586787 RESOLVED Certificate Misissuance Opened 2019-10-07 · Closed 2023-02-22 · 87% similar
Actalis: Issuance of intermediates after 2019-01-01 that do not comply with Mozilla Policy
#1708834 RESOLVED Certificate Misissuance Self Reported Incident Opened 2021-04-30 · Closed 2023-02-22 · 86% similar
GlobalSign: Invalid stateOrProvinceName and locality pair
#1645686 RESOLVED Certificate Misissuance Revocation Issue Opened 2020-06-14 · Closed 2023-02-22 · 85% similar
Sectigo: Lack of input validation in stateOrProvinceName
#1709392 RESOLVED Self Reported Incident Certificate Misissuance Opened 2021-05-04 · Closed 2023-02-22 · 85% similar
Asseco DS / Certum: Invalid stateOrProvinceName field (recurrent incident)

We use only essential cookies and local browser storage for preferences and security. See our Privacy Policy for details.

Confirm action