← Sectigo cases
Bugzilla #1736064
Ca Certificate Compliance
Certificate Misissuance
Self Reported Incident
Sectigo: Subject field with unvalidated information included in certificates
RESOLVED
FIXED
Sectigo
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Sectigo discovered that its systems had the potential to issue OV and EV certificates containing the postOfficeBox subject field, which is not permissible under current guidelines. This issue was identified during an internal code review on September 30, 2021. Following the discovery, Sectigo deployed a fix on October 10, 2021, and began investigating affected certificates. A total of 453 certificates were identified, with 428 OV and 25 EV certificates requiring revocation. The revocation of these certificates was scheduled for October 16, 2021. Sectigo has since implemented measures to prevent further issuance of certificates with unvalidated information.
Chronology
- Internal code review reveals potential to issue certificates with postOfficeBox.
- Fix deployed to prevent issuance of certificates with postOfficeBox.
- Revocation of affected certificates scheduled.
Thread Activity
- Sectigo — Created attachment detailing the issue with postOfficeBox subject field.
- Community commenter — Requested clarification on a specific certificate not included in the attachment.
- Sectigo — Created a corrected attachment with additional details on affected certificates.
- Sectigo — Discussed the importance of unique identifiers for certificates.
- Sectigo — Identified additional noncompliant EV certificates and scheduled revocation.
- Sectigo — Confirmed that the remediation for the issue was completed.
Participants
Sectigo
Community commenter
Mozilla representative
External References
Similar Local Cases
Sectigo: Failure to block disallowed LDH labels in domain names
Sectigo: Incorrect JOI for federal credit unions
Sectigo: Failure to provide timely incident reports
Sectigo: CPR response issues
Sectigo: Misspellings in stateOrProvince or localityName fields
Sectigo: DCV Reuse after 825 days
Sectigo: Inappropriate subject:serialNumber information in EV certificates obtained through ACME
Sectigo: EV SSL Certificates with incorrect subject details.