Sectigo: Misspellings in stateOrProvince or localityName fields

Sectigo reported a compliance issue involving misspellings in the stateOrProvince and localityName fields of nine certificates, which were initially brought to their attention via a report to their SSL Abuse line. Following an investigation, Sectigo acknowledged the errors and revoked the affected certificates between May 20 and May 23, 2021. They implemented a lookup table for the stateOrProvince field to prevent future errors, although they noted challenges with the localityName field due to its variable nature. Additionally, Sectigo conducted a broader review and revoked an additional 182 certificates with improper stateOrProvinceName values on August 1, 2021. The case is now resolved with the implementation of new controls to avoid similar issues in the future.

1. 2021-05-19 Certificates reported to Sectigo’s abuse address.
2. 2021-05-20 First certificate with errors revoked.
3. 2021-08-01 182 additional certificates with improper values revoked.

1. 2021-06-07 Sectigo — Sectigo received a report about misspellings in nine certificates.
2. 2021-06-14 Sectigo — Sectigo provided a thorough writeup of the incident and their mitigation plans.
3. 2021-08-03 Sectigo — Sectigo concluded their research into improper state or province names and revoked 182 certificates.
4. 2021-08-25 Mozilla representative — Bug is ready to be closed.