Sectigo: State name in localityName

RESOLVED FIXED Sectigo

This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update. Always refer to the official Bugzilla thread as the authoritative source. If you spot an inaccuracy, let me know via the contact form.

AI Summary

Sectigo discovered that six certificates were issued with 'Suffolk' in both the stateOrProvinceName and localityName fields, which led to a compliance issue. The CA identified the problem on July 9, 2021, and revoked the affected certificates by July 13, 2021. Sectigo has since removed the privileges of the responsible RA and is implementing changes to eliminate the localityName field from future certificates to prevent similar issues. The CA has also addressed a software bug that allowed for the reuse of validation information from removed RAs. The case has been resolved with a commitment to improved validation processes.

Model: gpt-4o-mini Generated: 2026-06-13 20:57 UTC Revised: 2026-06-16 18:53 UTC Confidence: 0.90 12 comments

Chronology

2021-07-09 Sectigo discovered six certificates with incorrect locality information.
2021-07-13 The remaining four certificates were revoked.
2021-07-25 Sectigo released a fix for the software bug related to RA validation.

Thread Activity

2021-07-15 Sectigo — Sectigo reported the discovery of the issue and outlined the timeline of events.
2021-07-22 Community commenter — Ryan raised concerns about the reuse of validation information from removed RAs.
2021-08-09 Sectigo — Tim confirmed that the fix for the software bug was released.
2021-08-12 Sectigo — Tim provided additional context on the validation process and the decision to revoke a new certificate.
2021-08-30 Mozilla representative — Bug was slated for closure.

Participants

Sectigo Community commenter Mozilla representative

External References

Original Bugzilla Case

Similar Local Cases

#1740493 RESOLVED Ca Certificate Compliance Certificate Misissuance Self Reported Incident Opened 2021-11-10 · Closed 2023-02-22 · 100% similar

Sectigo: Failure to block disallowed LDH labels in domain names

AI Summary CA Owner

#1741026 RESOLVED Ca Certificate Compliance Revocation Issue Self Reported Incident Opened 2021-11-13 · Closed 2023-02-22 · 100% similar

Sectigo: Incorrect JOI for federal credit unions

AI Summary CA Owner

#1563579 RESOLVED Ca Certificate Compliance Self Reported Incident Opened 2019-07-04 · Closed 2023-02-22 · 100% similar

Sectigo: Failure to provide timely incident reports

AI Summary CA Owner

#1650845 RESOLVED Ca Certificate Compliance Self Reported Incident Opened 2020-07-06 · Closed 2024-06-30 · 100% similar

Sectigo: CPR response issues

AI Summary CA Owner

#1724458 RESOLVED Ca Certificate Compliance Opened 2021-08-06 · Closed 2023-02-22 · 100% similar

Sectigo: Mojibake in certificate Subject fields

AI Summary CA Owner

#1736064 RESOLVED Ca Certificate Compliance Certificate Misissuance Self Reported Incident Opened 2021-10-15 · Closed 2023-02-22 · 97% similar

Sectigo: Subject field with unvalidated information included in certificates

AI Summary CA Owner

#1593776 RESOLVED Ca Certificate Compliance Incident Opened 2019-11-04 · Closed 2023-02-22 · 97% similar

Sectigo: invalid subject:organizationalUnitName on DV certificates

AI Summary CA Owner

#1575022 RESOLVED Ca Certificate Compliance Certificate Misissuance Self Reported Incident Opened 2019-08-19 · Closed 2023-02-22 · 96% similar

Sectigo: EV SSL Certificates with incorrect subject details.

AI Summary CA Owner