SwissSign: wrong address in EV certificate

SwissSign reported an EV certificate compliance issue it detected during a 12-month review of EV customers: the street field was wrong in 80 EV certificates for one customer. SwissSign’s RA reviewed the affected EV fields with a first and second pair of eyes, and the second confirmation triggered correction of the certificate data. Information Security & Compliance was informed and an investigation started, and SwissSign informed its auditors and listed the valid mis-issued certificates issued in 2021. SwissSign stated that it corrected the address and informed the customer to request new certificates and then revoke the mis-issued certificates. SwissSign later reported that it revoked all 80 certificates on 2021-10-09 21:49 UTC. Mozilla indicated it would close the bug on 20-Oct-2021 unless questions remained, and the bug is marked RESOLVED with resolution FIXED.

1. 2021-10-04 SwissSign’s RA began reviewing EV certificate fields for the affected customer’s certificates.
2. 2021-10-05 SwissSign confirmed the wrong street address in EV certificates and started the mis-issued certificate process.
3. 2021-10-09 SwissSign revoked all 80 mis-issued EV certificates.

1. 2021-10-05 SwissSign AG — Created the incident report stating SwissSign detected wrong street fields in 80 EV certificates during its EV customer review and provided a timeline and remediation steps.
2. 2021-10-11 SwissSign AG — Updated the bug stating revocation of all 80 certificates was completed and that there were no more open tasks from SwissSign’s point of view.
3. 2021-10-14 Mozilla representative — Said Mozilla would call it up on 20-Oct-2021 and close it unless questions still needed answering.