Camerfirma invalid stateOrProvinceName values in issued certificates

This case concerns certificates issued by Camerfirma and its SubCAs with an invalid subject:stateOrProvinceName value. The issue was first reported by George [:fozzie] on 2020-09-25, who pointed to a batch of certificates and argued that Camerfirma had misread the Baseline Requirements. Camerfirma said the problem came from a misinterpretation of the BRs, stopped issuing affected certificates on 2020-09-30, and began a substitution and revocation plan. Over time, Camerfirma provided updated counts, attachments, and revocation progress, including additional affected certificates found during a manual review. Camerfirma later stated that all affected certificates had been revoked on 2021-01-15, and subsequent comments only said there were no further updates.

1. 2020-09-25 A batch of Camerfirma-issued certificates with invalid stateOrProvinceName values was reported.
2. 2020-09-30 Camerfirma stopped issuing certificates with the affected profiles and began substitution/revocation planning.
3. 2021-01-12 Camerfirma detected 8 additional affected certificates during manual review and revoked them immediately.
4. 2021-01-15 Camerfirma stated that all affected certificates had been revoked.

1. 2020-09-25 Fozzie representative — Reported a batch of certificates to Camerfirma and said the stateOrProvinceName value "Italy" appeared invalid.
2. 2020-09-28 AC Camerfirma, S.A. — Said Camerfirma was investigating affected certificates and described the issue as a BR misinterpretation.
3. 2020-09-29 AC Camerfirma, S.A. — Said Camerfirma would open a separate bug for revocation delay and would work to stop issuance and change the profiles.
4. 2020-09-30 AC Camerfirma, S.A. — Provided an incident timeline, said issuance had stopped, and listed affected certificate counts by SubCA.
5. 2020-10-02 AC Camerfirma, S.A. — Updated the incident report with a revised timeline and said new controls would be added for SubCA profile review.
6. 2020-10-16 AC Camerfirma, S.A. — Reported partial revocation progress and said some certificates remained pending due to customer replacement needs.
7. 2020-12-22 AC Camerfirma, S.A. — Said 27 additional affected certificates had been detected and published on misissued.com.
8. 2021-01-08 AC Camerfirma, S.A. — Said Camerfirma was still manually reviewing stateOrProvince values across the affected SubCAs.
9. 2021-01-13 AC Camerfirma, S.A. — Said the manual review found 8 more affected certificates, which were revoked immediately.
10. 2021-01-15 AC Camerfirma, S.A. — Stated that all affected certificates had been revoked.