Sectigo: Truncated registration numbers in EV certificates

Sectigo reported that, after reviewing DigiCert bug 1727963, it found similar truncation behavior in some of its EV certificates. The issue was that the subject:serialNumber values in certain EV certificates were truncated to 25 characters, discarding the remainder. Sectigo stated that it corrected the technical problem by deploying a fix that limited the subject:serialNumber field to 64 characters and rejected certificate orders with longer fields instead of issuing truncated contents. Sectigo identified 38 affected certificates issued between September 16, 2019 and July 13, 2021 and scheduled revocation for the affected certificates. In a later comment, Sectigo confirmed that the scheduled revocation went as expected. The bug was then closed after Sectigo stated it had completed full remediation and dealt with all misissued certificates, with Mozilla indicating it would close the bug if no further questions were raised.

1. 2021-09-19 Sectigo deployed a fix to stop truncating EV certificate subject:serialNumber values beyond 25 characters.
2. 2021-09-25 Sectigo scheduled revocation of the affected EV certificates with truncated subject:serialNumber values.

1. 2021-09-24 Sectigo — Sectigo explained it discovered 25-character truncation of EV certificate subject:serialNumber values during a review of DigiCert bug 1727963, deployed a fix limiting the field to 64 characters, and listed affected certificates and planned revocation.
2. 2021-09-30 Sectigo — Sectigo confirmed the scheduled revocation went as expected on Saturday.
3. 2021-10-25 Sectigo — Sectigo stated it completed full remediation, dealt with all misissued certificates, and asked to close the bug.
4. 2021-10-25 Mozilla representative — Mozilla said it would close the bug on Wed 27-October-2021 unless there were additional questions or requests for clarification.