DigiCert: TERENA: Insufficient validation of organizationalUnitName
Michel Le Bihan reported two DigiCert-issued certificates associated with TERENA that he said had expired and involved `organizationalUnitName` values containing `Informatyzacja Uczelni` with specific CNs. He noted that one certificate was revoked a day after issuance and asked whether this could be a misissuance issue, but said he was reporting it “just in case.” Mozilla staff responded that the certificates expired in early 2019 and questioned whether they might have been reported previously, stating they were not sure anything actionable remained. George Fozzie Dev said that even if there were a violation, DigiCert had implemented constraints for this field in another bug (1639032). Jeremy Rowley from DigiCert replied that the certificates had been expired for almost two years, that DigiCert had turned off OU in general with some exception accounts, and that DigiCert had implemented additional checking and redid its validation system referenced in bug 1639032. The bug was resolved as INVALID.
- Michel Le Bihan reported two DigiCert-issued certificates with `organizationalUnitName` values that he said were insufficiently validated and later expired/revoked.
- Mozilla staff and other participants discussed whether the certificates were already known and whether there was any actionable remediation given their age.
- DigiCert stated it had implemented constraints and validation changes for this field and had turned off OU generally with exceptions.
- Lebihan representative — Reported two certificates (crt.sh links) that he said expired and involved specific `organizationalUnitName` values, and asked if it could be misissuance.
- Mozilla representative — Asked how to know the certificates weren’t already reported and said they were not sure anything actionable remained.
- Fozzie representative — Said that even if it were a violation, DigiCert had implemented constraints for this field in bug 1639032.
- DigiCert — Stated the certificates had been expired for almost two years, OU was turned off generally with exceptions, and DigiCert redid validation and checking referenced in bug 1639032 and a related URL.