← Sectigo cases
Bugzilla #1710243
Certificate Misissuance
Sectigo: Invalid stateOrProvinceName
RESOLVED
FIXED
Sectigo
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
This case involves Sectigo's disclosure of a compliance issue regarding the use of invalid stateOrProvinceName values in certificates. The issue was initially reported on May 8, 2021, when a certificate with 'stateOrProvinceName: Moldova' was identified. Sectigo acknowledged the problem and subsequently revoked six certificates with invalid state names, including those with 'Malta' and 'Moldova'. The CA has since implemented a lookup table based on ISO 3166-2 to prevent future occurrences of similar issues. The case has been resolved with all identified certificates revoked.
Chronology
- Initial report of a certificate with invalid stateOrProvinceName.
- Sectigo revokes six certificates with invalid state names.
Thread Activity
- Lebihan representative — Reported a certificate with 'stateOrProvinceName: Moldova'.
- Sectigo — Acknowledged the issue and indicated it predates a previous bug.
- Sectigo — Announced the decision to revoke the identified certificates.
- Sectigo — Confirmed that all six identified certificates have been revoked.
Participants
Lebihan representative
Sectigo
Mozilla representative
External References
Similar Local Cases
Sectigo: Misspellings in stateOrProvince or localityName fields
Sectigo: Invalid postalCode field
Sectigo: Inappropriate subject:serialNumber information in EV certificates obtained through ACME
Sectigo: Failure to block disallowed LDH labels in domain names
Sectigo: Lack of input validation in stateOrProvinceName
Sectigo: Subject field with unvalidated information included in certificates
Sectigo: SC45 DCV Reuse Error
Sectigo: test certificates issued from trusted CA