DigiCert: Invalid stateOrProvinceName

Michel Le Bihan reported that two DigiCert OV certificates contained `stateOrProvinceName: MALTA` and linked to the certificates on crt.sh. DigiCert responded that the certificates were OV and that Malta is a state in Malta according to ISO 3166-2:MT, but the discussion raised questions about which subdivision name was intended. DigiCert later stated that it filed an incident report and reviewed the issue: after an additional review, it determined the state and locality values were not congruent and that the certificates should be revoked. DigiCert said it had deployed an address checking tool in September 2019, and that the affected certificates were issued before that tool was deployed; DigiCert also described earlier scans as having labeled similar findings as false positives. DigiCert scheduled revocation and sent notice to impacted subscribers, including planned revocation for the two Malta certificates on 05/14/2020 (as stated in the incident report) and planned revocation for a third related certificate on 05/17/2021. Mozilla indicated the bug could be closed and anticipated closing it next Wednesday, 2-June-2021. The bug is marked RESOLVED with resolution FIXED.

1. 2021-05-10 A bug was filed identifying two DigiCert OV certificates with `stateOrProvinceName: MALTA`.
2. 2021-05-12 DigiCert completed its review and identified additional certificates requiring further review, then scheduled revocation and notified subscribers.
3. 2021-05-14 DigiCert planned revocation for the two Malta certificates identified in the bug.
4. 2021-05-17 DigiCert planned revocation for an additional related certificate (as described in the incident report).
5. 2021-05-27 Mozilla indicated the matter could be closed and anticipated closing it on 2-June-2021.

1. 2021-05-10 Lebihan representative — Reported two certificates with `stateOrProvinceName: MALTA` and provided crt.sh links.
2. 2021-05-10 DigiCert — Said these are OV certs and that Malta is appropriate as the State per ISO 3166-2:MT.
3. 2021-05-10 Thisisntrocket representative — Asked which ISO_3166-2:MT subdivision was being referenced and noted that names should appear in full (e.g., like 'New York' vs 'York').
4. 2021-05-12 Lebihan representative — Referenced another CA revoking for the same reason and questioned why one CA would treat the values differently.
5. 2021-05-12 DigiCert — Indicated DigiCert was working on a response and would provide it shortly.
6. 2021-05-14 DigiCert — Provided a self-initiated incident report describing awareness, review, and planned revocation actions, including CT/crt.sh identifiers and a timeline.
7. 2021-05-27 DigiCert — Asked whether anything else was needed before closing the bug.
8. 2021-05-27 Mozilla representative — Said the matter could be closed and anticipated closing it next Wednesday, 2-June-2021.