Sectigo: Incorrect EV businessCategory

RESOLVED FIXED Sectigo

This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update. Always refer to the official Bugzilla thread as the authoritative source. If you spot an inaccuracy, let me know via the contact form.

AI Summary

Sectigo reported a compliance issue involving two EV certificates that contained incorrect businessCategory information. The CA became aware of the problem on June 3, 2021, through a report received via their SSL abuse line. Following an investigation, Sectigo confirmed the misissuance on June 4 and revoked both certificates on June 8. The CA attributed the issue to human error and stated that they have implemented a Guard Rails project to prevent similar incidents in the future. The project includes checks for logical conflicts in certificate fields, with updates on progress shared in the bug thread. The incident is now resolved, and the bug has evolved into a repository for ongoing discussions about the Guard Rails initiative.

Model: gpt-4o-mini Generated: 2026-06-13 20:58 UTC Revised: 2026-06-16 18:52 UTC Confidence: 0.90 27 comments

Chronology

2021-06-03 Report received about two EV certificates with erroneous businessCategory information.
2021-06-04 Investigation concluded and misissuance confirmed.
2021-06-08 Both certificates revoked.
2021-08-04 StateOrProvinceName-localityName exclusivity check deployed.

Thread Activity

2021-06-11 Sectigo — Sectigo disclosed the misissuance incident and outlined their response timeline.
2021-06-21 Sectigo — Sectigo committed to sharing details of the Guard Rails project as they are implemented.
2021-07-08 Sectigo — Sectigo announced the feature for matching businessCategory and serialNumber for government entities.
2021-08-02 Sectigo — Sectigo deployed stateOrProvinceName-localityName exclusivity.
2021-08-13 Sectigo — Sectigo indicated that the originating incident is resolved and the bug will be closed.

Participants

Community commenter

External References

Original Bugzilla Case

Similar Local Cases

#1714193 RESOLVED Certificate Misissuance Self Reported Incident Opened 2021-06-02 · Closed 2023-02-22 · 100% similar

Sectigo: Incorrect locality information

AI Summary CA Owner

#1714628 RESOLVED Incident Self Reported Incident Opened 2021-06-04 · Closed 2023-02-22 · 96% similar

Sectigo: Forbidden Domain Validation Method

AI Summary CA Owner

#1575022 RESOLVED Ca Certificate Compliance Certificate Misissuance Self Reported Incident Opened 2019-08-19 · Closed 2023-02-22 · 93% similar

Sectigo: EV SSL Certificates with incorrect subject details.

AI Summary CA Owner

#1715024 RESOLVED Certificate Misissuance Self Reported Incident Opened 2021-06-07 · Closed 2023-02-22 · 93% similar

Sectigo: Misspellings in stateOrProvince or localityName fields

AI Summary CA Owner

#1548713 RESOLVED Self Reported Incident Revocation Issue Opened 2019-05-02 · Closed 2023-02-22 · 91% similar

Sectigo: "Default City" in Subject:localityName

AI Summary CA Owner

#1740493 RESOLVED Ca Certificate Compliance Certificate Misissuance Self Reported Incident Opened 2021-11-10 · Closed 2023-02-22 · 89% similar

Sectigo: Failure to block disallowed LDH labels in domain names

AI Summary CA Owner

#1551362 RESOLVED Self Reported Incident Revocation Issue Opened 2019-05-14 · Closed 2023-02-22 · 89% similar

Sectigo: "Some-State" in stateOrProvinceName

AI Summary CA Owner

#1619359 RESOLVED Self Reported Incident Opened 2020-03-02 · Closed 2023-02-22 · 89% similar

Sectigo: Failure to provide a preliminary report within 24 hours

AI Summary CA Owner