GlobalSign: Incorrect Jurisdiction of Incorporation information for Japan (EV SSL)
GlobalSign reported that, while reviewing Jurisdiction of Incorporation (JOI) information for upcoming publication of Incorporating Sources, it discovered EV SSL certificates that included JOI information at the State and Locality level for Japan, which GlobalSign stated should be at the country level. GlobalSign said it discovered an initial certificate on 13 August 2020 and then found two additional certificates after further investigation. GlobalSign initiated replacement of the certificates with the customer and stated it would revoke them by the Baseline Requirements deadline. The bug thread includes updates confirming the original three certificates were revoked and describing ongoing investigation and additional remediation work, including further analysis that later identified additional certificates with wrong JOI information and their subsequent revocation. GlobalSign also stated it had not stopped issuing EV certificates, but had put additional controls in place and published a list of Incorporating and Registration Agencies and relevant JOI information. Mozilla indicated it would schedule the bug for closure on 16 October 2020 unless further questions or issues were raised, and the bug is marked RESOLVED with resolution FIXED.
- GlobalSign discovered EV SSL certificates with incorrect Japan Jurisdiction of Incorporation granularity during JOI review for Incorporating Sources publication.
- GlobalSign confirmed revocation of the original three affected certificates.
- GlobalSign revoked additional certificates identified as having wrong Jurisdiction of Incorporation information.
- GlobalSign published a list of Incorporating and Registration Agencies and relevant Jurisdiction of Incorporation information and requested closure.
- GlobalSign nv-sa — GlobalSign reported discovery of three EV SSL certificates with redundant/incorrect Japan Jurisdiction of Incorporation information and said it was working with the customer to replace them and revoke by 18 August 2020.
- GlobalSign nv-sa — GlobalSign provided an intermediate update confirming the original three certificates were revoked and that a detailed report would follow by 21 August 2020.
- GlobalSign nv-sa — GlobalSign added an update describing how it became aware of the issue, a timeline of actions taken, and remediation steps.
- GlobalSign nv-sa — GlobalSign stated the review of non-private organizations was ongoing (about 80% complete) and that an escalation filter remained in place for non-Private Organisations.
- GlobalSign nv-sa — GlobalSign reported additional certificates (37 for 11 customers) with wrong Jurisdiction of Incorporation information and said they were revoked after confirmation they did not meet requirements.
- Mozilla representative — Mozilla asked what remains to be done for remediation of the underlying issue(s) related to the bug.
- GlobalSign nv-sa — GlobalSign stated it published a list of Incorporating and Registration Agencies and relevant JOI information, noted the escalation filter remained for certain Government Entities, and asked to close the ticket.
- Mozilla representative — Mozilla thanked GlobalSign and said it would schedule the bug for closure on about 16 October 2020 unless other questions or issues were raised.