← Sectigo cases
Bugzilla #1712120
Certificate Misissuance
Sectigo: Inappropriate subject:serialNumber information in EV certificates obtained through ACME
RESOLVED
FIXED
Sectigo
AI Summary
Sectigo identified a misissuance of Extended Validation (EV) TLS certificates where the subject:serialNumber field incorrectly contained dates of incorporation instead of the appropriate registration numbers. This issue was discovered during an internal audit, leading to a series of corrective actions including disabling access to the EV ACME server and revoking 204 affected certificates. The root cause was traced to a coding bug in the ACME order processing system, which failed to retrieve the correct registration number from the database. Sectigo has since implemented automated testing to prevent similar issues in the future.
Chronology
- Internal audit discovers misissuance of EV TLS certificates.
- List of affected certificates generated.
- All affected certificates revoked.
- Automated tests for ACME issuance added.
Participants
Tim Callan
Ryan Sleevi
Nikola Maksimovic
External References
Similar Local Cases
Sectigo: State name in localityName
Sectigo: Incorrect JOI for federal credit unions
Sectigo: Incorrect EV businessCategory
Sectigo: Invalid stateOrProvinceName
Sectigo: test certificates issued from trusted CA
Sectigo: Forbidden Domain Validation Method
Sectigo: Failure to revoke within 5 days
Sectigo: Subject field with unvalidated information included in certificates