DigiCert: Invalid localityName (Warszaw vs Warszawa)

The bug was opened after an external reporter identified two DigiCert certificates whose `localityName` value was `Warszaw`, which the reporter said was incorrect and should be `Warsaw` (English) / `Warszawa` (Polish). DigiCert responded that `Warszaw` is an acceptable spelling and provided examples from government and other sites. The Mozilla community did not immediately agree that the issue should be treated as invalid, noting it as a minor issue involving two accepted spellings. DigiCert later provided an incident report describing how it became aware of the certificates via the Bugzilla report, the timeline of its responses, and that it revoked the two certificates identified in the bug. The incident report also stated that DigiCert implemented an address checking tool in September 2019 to verify locality/state/country combinations before permitting issuance, and that these certificates were issued before that tool was integrated. The bug was ultimately resolved as FIXED, with Mozilla indicating it could be closed and anticipating doing so on 2 June 2021.

1. 2021-05-12 A Bugzilla report was filed identifying two DigiCert certificates with `localityName: Warszaw`.
2. 2021-05-14 DigiCert provided additional references supporting `Warszaw` as an alternate spelling.
3. 2021-05-19 DigiCert revoked the two certificates identified in the bug.
4. 2021-05-27 DigiCert requested closure of the bug.
5. 2021-06-02 Mozilla anticipated closing the bug.

1. 2021-05-12 Lebihan representative — Reported two DigiCert certificates with `localityName: Warszaw` and argued it should be `Warsaw`/`Warszawa`, linking to crt.sh entries.
2. 2021-05-12 DigiCert — Said `Warszaw` is an acceptable spelling and cited an example government site.
3. 2021-05-12 Community commenter — Suggested closing as RESOLVED/INVALID and advised reporting directly to the CA’s problem reporting contact for faster response.
4. 2021-05-12 Lebihan representative — Asked for more examples supporting `Warszaw` as acceptable.
5. 2021-05-12 Mozilla representative — Indicated Mozilla was not inclined to close it as Invalid at that time.
6. 2021-05-14 DigiCert — Provided multiple references and argued that `Warszaw` is a common alternate spelling.
7. 2021-05-14 Fozzie representative — Commented that `Warszaw` appears to be a typo of `Warszawa` based on search behavior and provided an example reference.
8. 2021-05-21 DigiCert — Submitted DigiCert’s incident report, including the timeline and stating the two certificates were revoked.
9. 2021-05-27 DigiCert — Asked if anything else was needed and requested closure.
10. 2021-05-27 Mozilla representative — Said the matter could be closed and anticipated closing it next Wednesday, 2-June-2021.