← Sectigo cases
Bugzilla #1708934
Certificate Misissuance
Sectigo: Invalid postalCode field
RESOLVED
FIXED
Sectigo
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Sectigo identified a compliance issue regarding the postalCode field in several certificates, where invalid values such as a series of zeros were used. The issue was reported on May 1, 2021, leading to an acknowledgment from Sectigo the following day. The CA investigated and found that 45 certificates issued to Hong Kong contained incorrect postal code information. Sectigo decided to revoke these certificates, with the revocation process completed by May 21, 2021. They also committed to not issuing certificates with invalid postal codes in the future and are reviewing other potentially affected certificates.
Chronology
- Bug filed regarding invalid postalCode values in Sectigo certificates.
- Revocation of 45 certificates with invalid postalCode values completed.
Thread Activity
- Fozzie representative — Created bug report about invalid postalCode field in Sectigo certificates.
- Sectigo — Acknowledged receipt of the notification and promised a full report soon.
- Sectigo — Announced the decision to revoke certificates with invalid postal codes.
- Sectigo — Completed revocation of the identified certificates.
Participants
Fozzie representative
Sectigo
Community commenter
Mozilla representative
External References
Similar Local Cases
Sectigo: Failure to block disallowed LDH labels in domain names
Sectigo: Lack of input validation in stateOrProvinceName
Sectigo: Inappropriate subject:serialNumber information in EV certificates obtained through ACME
Sectigo: test certificates issued from trusted CA
Sectigo: Misspellings in stateOrProvince or localityName fields
Sectigo: Subject field with unvalidated information included in certificates
Sectigo: EV SSL Certificates with incorrect subject details.
Sectigo: Invalid stateOrProvinceName