Sectigo: Incorrect JOI for federal credit unions

Sectigo identified a misissuance involving eleven certificates issued to federal credit unions that incorrectly included state-level information in the JOIStateName fields. The issue was discovered during a review of their certificate corpus, leading to the revocation of the affected certificates. Although the initial discovery occurred on October 7, 2021, the reporting of the incident was delayed due to a series of development schedule slips, which Sectigo acknowledged as a mismanagement error. The CA has since implemented programmatic checks to prevent similar misissuances in the future.

1. 2021-10-07 Discovery of misissued certificates
2. 2021-10-12 First certificate revoked
3. 2021-10-13 Additional certificates revoked
4. 2021-11-06 QGIS matching goes into production
5. 2021-12-14 Bug scheduled for closure