Asseco DS / Certum: Incorrect localityName
The bug was opened after Michel Le Bihan noticed a certificate on crt.sh with `localityName: Biała` and `stateOrProvinceName: mazowieckie`, which he believed was incorrect because there is no such locality in that voivodeship. He pointed to similarly named localities such as `Stara Biała` and other `Biała` entries in different voivodeships, and referenced checking via https://eteryt.stat.gov.pl/. Mozilla staff (Ryan Sleevi) noted they were waiting for an incident report from Asseco DS / Certum on a different bug (1709392) and asked that this issue be filed as a separate incident report so they could independently determine whether to duplicate, including identifying the data source(s) used to validate the EV certificate per Ballot SC30. Michel responded with questions about whether `localityName` should be the smallest administrative unit or could be a city/town/village, and Ryan explained that locality can contain cities/towns/villages and that the CA must demonstrate the relevant data source and verification used to determine locality. The bug was resolved as INVALID.
- A certificate localityName concern was raised based on crt.sh data for an EV certificate.
- Lebihan representative — Reported that a crt.sh certificate showed `localityName: Biała` with `stateOrProvinceName: mazowieckie` and argued it was wrong, citing alternative similarly named localities and https://eteryt.stat.gov.pl/.
- Community commenter — Said Mozilla was waiting for an incident report from Asseco DS / Certum on Bug 1709392, held off duplicating for now because the issue involved an EV certificate vs OV in that other bug, and asked for a separate incident report including the data source(s) used to validate the EV certificate per Ballot SC30.
- Lebihan representative — Commented that `Biała` (SIMC 0576036) appears to make the locality look OK.
- Lebihan representative — Asked whether `localityName` can be just a city/town/village or must be the smallest administrative subdivision unit.
- Community commenter — Explained that locality can contain cities/towns/villages, that locality determination depends on the CA’s demonstrated data source and verification, and referenced RFC guidance (including RFC 2256) while noting the recommended reporting path to the CA.