← SSL.com cases
Bugzilla #1722089
Incident
SSL.com: Issuance of 3 EV TLS certificates without 2-person validation of the organization information
RESOLVED
FIXED
SSL.com
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
SSL.com reported a compliance failure involving the issuance of three Extended Validation (EV) TLS certificates without the required two-person validation. The issue was discovered by their validation team during a routine check. Upon investigation, it was found that a bug in their API allowed certificates to be issued without proper approval. SSL.com promptly revoked the affected certificates and implemented a hotfix to prevent further occurrences. They have since conducted a thorough review of their processes and are updating their documentation and training to enhance compliance and prevent similar issues in the future.
Chronology
- All three affected certificates revoked.
Thread Activity
- SSL.com — Filed initial Bugzilla report.
- SSL.com — This is our final report on this issue.
- Mozilla representative — It appears that the remediation items have been completed.
Participants
SSL.com
Community commenter
Mozilla representative
External References
Similar Local Cases
SSL.com: Issuance of TLS certificates with domain validation methods prohibited by SC-45
SSL.com: Failure to process CAA records from one SubCA
SSL.com: CAA Empty set handling results in Wildcard issuance
SSL.com: Delay in publishing OCSP responses
SSL.com: Precertificates without corresponding certificates return OCSP value of "Unknown"
SSL.com: Issuance of certificates using keys previously reported as compromised
KIR S.A.: DV certificates with locality name, organization name and stateOrProvinceName
IdenTrust: Validation Source for EV Certificates not Publicly Disclosed