GlobalSign: Invalid stateOrProvinceName and locality pair

GlobalSign identified a compliance issue involving the issuance of certificates with incorrect state and locality values. The problem was reported through Bugzilla and an internal certificate problem report. In response, GlobalSign suspended issuance from the affected profile and initiated an investigation. They acknowledged the inaccuracies in the locality field and committed to revoking the affected certificates. A detailed incident report was provided, outlining the steps taken to rectify the issue, including a root cause analysis and the implementation of new validation rules to prevent future occurrences. The case has been resolved with all identified certificates revoked.

1. 2021-04-30 GlobalSign received reports of invalid stateOrProvinceNames and locality pairs in issued certificates.
2. 2021-05-01 GlobalSign suspended issuance from the affected profile and began an investigation.
3. 2021-06-04 GlobalSign completed a root cause analysis and identified specific issues leading to the misissuance.
4. 2021-09-30 GlobalSign implemented changes to their sources database to address the identified issues.

1. 2021-04-30 Fozzie representative — GlobalSign has issued a number of certificates with invalid stateOrProvinceNames.
2. 2021-05-01 GlobalSign nv-sa — We have urgently looked into this approval and acknowledged the inaccurate value in the locality field.
3. 2021-05-05 GlobalSign nv-sa — Created attachment with incident report detailing the actions taken.
4. 2021-09-30 GlobalSign nv-sa — Changes to the sources database have been implemented as described in Comment 20.