DigiCert: Entity not verified in organizationalUnitName
This case concerns two DigiCert-issued certificates that included the text "OpenSSL" in the certificate field organizationalUnitName. The reporter argued this violated BR 7.1.4.2.2 i) because the OU attribute included a trademark/legal-entity-related term without sufficient verification under Section 3.2. DigiCert responded that the information was verified in accordance with Section 3.2 and that permission for Verizon to use the term OpenSSL in this context had been obtained, characterizing the issue as a false positive. DigiCert also stated that it is actively removing OU from certificates in anticipation of an upcoming CAB Forum change that would prohibit them going forward, but that for now it believed the requirement was met. DigiCert further argued that the BR language requires verification via a reliable data source for the right to use, and that the verification was performed in accordance with Section 3.2. Mozilla asked whether there were objections to closing the bug based on DigiCert’s arguments, and the bug was then closed as invalid (resolution: FIXED).
- DigiCert issued two certificates containing "OpenSSL" in the organizationalUnitName field.
- A CA Certificate Compliance bug was opened alleging non-compliance with BR 7.1.4.2.2 i) regarding OU content and verification.
- Mozilla closed the bug after confirming no objections to DigiCert’s arguments.
- Fozzie representative — Reported that two certificates had "OpenSSL" in organizationalUnitName and claimed this violated BR 7.1.4.2.2 i) unless verified under Section 3.2.
- DigiCert — Argued the issue was a false positive because the information was verified under Section 3.2 and permission for Verizon to use "OpenSSL" was obtained.
- Fozzie representative — Questioned whether DigiCert’s verification matched the reporter’s understanding of trademark ownership/verification requirements and requested evidence of verification for Verizon’s permission.
- DigiCert — Quoted the BR language and the relevant trademark license terms, asserting that verification under 3.2 was the requirement and that the OU inclusion was permitted.
- Fozzie representative — Asked how DigiCert verified the trademark licensing terms (website review vs email) and suggested contacting the trademark owner directly to reduce ambiguity.
- DigiCert — Stated DigiCert was removing OU in anticipation of a CAB Forum change, and maintained that verification via a reliable data source under Section 3.2 was sufficient, requesting closure as invalid.
- Mozilla representative — Asked whether there were any objections to closing the bug based on DigiCert’s arguments.
- Mozilla representative — Indicated the bug would be closed on or about 27-November-2020.