← Sectigo cases
Bugzilla #1715024
Certificate Problem Report
Sectigo: Misspellings in stateOrProvince or localityName fields
RESOLVED
FIXED
Sectigo
AI Summary
Sectigo identified and resolved issues related to misspellings in the stateOrProvince and localityName fields of nine certificates. The problem was first reported on May 19, 2020, leading to a swift investigation and acknowledgment of errors. All affected certificates were revoked by May 23, 2020. The root cause was attributed to human error during the issuance process, particularly in the localityName field, which lacks systematic checks. Sectigo has since implemented a lookup table for the stateOrProvince field to prevent future occurrences, although challenges remain for the localityName field due to its variable nature.
Chronology
- Certificates reported to Sectigo's abuse address.
- First certificate revoked.
- All remaining certificates revoked.
Participants
Tim Callan
Ryan Sleevi
Ben Wilson
External References
Similar Local Cases
Sectigo: Mojibake in certificate Subject fields
Sectigo: Lack of input validation in stateOrProvinceName
Sectigo: CPR response issues
Sectigo: ZeroSSL: failure to revoke within 24 hours
Sectigo: OCSP responses directly signed using root certificates without KU=digitalSignature
Sectigo: "Manual DCV" method used
Sectigo: Inadequate DCV
Sectigo: QWAC certificates issued with incorrect subject:organizationIdentifier attribute value