KIR S.A.: DV certificates with locality name, organization name and stateOrProvinceName

Krajowa Izba Rozliczeniowa S.A. (KIR) identified a compliance issue involving the issuance of DV certificates that incorrectly included organizationName, localityName, and stateOrProvinceName fields. The CA became aware of the problem shortly after the certificates were issued on September 17, 2020, and revoked them the same day. KIR initially did not classify this as an incident due to the timing of the policy changes but later acknowledged the oversight and committed to improving their incident reporting processes. The issue has been addressed, and KIR has implemented measures to prevent similar occurrences in the future.

1. 2020-09-17 KIR S.A. issued two DV certificates with incorrect fields.
2. 2020-09-17 KIR S.A. revoked the certificates after identifying the issue.

1. 2021-04-16 Lebihan representative — Reported finding two certificates with incorrect fields.
2. 2021-04-17 Kir representative — Inquired if an incident report was necessary.
3. 2021-04-19 Community commenter — Expressed concern over KIR's misunderstanding of the incident.
4. 2021-04-20 Kir representative — Agreed to provide a more detailed incident report.
5. 2021-07-12 Mozilla representative — Closed the bug while noting ongoing concerns about KIR's compliance.