← Asseco Data Systems S.A. cases
Bugzilla #1709392
Self Reported Incident
Certificate Misissuance
Asseco DS / Certum: Invalid stateOrProvinceName field (recurrent incident)
RESOLVED
FIXED
Asseco Data Systems S.A.
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Asseco Data Systems S.A. (Certum) reported a recurrent issue regarding the invalid 'stateOrProvinceName' field in several certificates. The problem was initially identified by a third party on May 4, 2021, prompting Certum to conduct a thorough analysis and implement corrective measures. They discovered multiple certificates with incorrect values and initiated revocation procedures. By May 12, 2021, five certificates were revoked, and further analysis revealed additional errors, leading to the revocation of 23 more certificates by May 15, 2021. Certum has committed to improving its validation processes to prevent future occurrences.
Chronology
- Certum received a report from a third party about incorrect stateOrProvinceName values in issued certificates.
- Certum revoked five certificates with invalid stateOrProvinceName values.
- Certum revoked an additional 23 certificates identified with errors in the stateOrProvinceName field.
Thread Activity
- Fozzie representative — Reported multiple certificates with invalid stateOrProvinceNames, indicating a recurrent issue.
- Assecods representative — Acknowledged the report and stated that an incident report would be forthcoming.
- Assecods representative — Provided a detailed timeline of actions taken in response to the issue.
- Assecods representative — Confirmed the revocation of five certificates with invalid stateOrProvinceName.
- Assecods representative — Reported the revocation of an additional 23 certificates with errors.
Participants
Fozzie representative
Assecods representative
Community commenter
Lebihan representative
Asseco Data Systems S.A.
Mozilla representative
External References
Related Bugzilla IDs Mentioned
Similar Local Cases
Asseco DS / Certum: CAA Mis-Issuance on CNAME pointing directly to restrictive CAA record
Asseco DS / Certum: Incorrect OCSP response encoding
Asseco DS / Certum: Failure to provide a preliminary report within 24 hours.
Asseco DS / Certum: Incorrect localityName
Asseco DS / Certum: Subordinate certificates with sequential serial number
GlobalSign: Invalid stateOrProvinceName and locality pair
Asseco DS / Certum: TLS EV certificates with incorrect Subject attribute order
Asseco DS / Certum: Organization Identifier and Country field discrepancies