GlobalSign: EV certificates with serialNumber "Government Entity" and businessCategory "Private Organization"

GlobalSign reported that it had issued two EV SSL certificates where the certificate fields serialNumber "Government Entity" and businessCategory "Private Organization" were inconsistent. The issue was triggered when GlobalSign received a certificate problem report via r**********e@globalsign.com at 17:17 UTC on 03/12/2021, which led its SOC to escalate to the Compliance team and start an investigation at 21:37 UTC the same day. GlobalSign confirmed the two certificates required revocation, initiated a replacement process, and halted issuance on the affected profile pending updates to the profile. The CA completed a review of historically issued certificates and outstanding requests and stated that no additional affected certificates or outstanding requests were identified. GlobalSign revoked the certificates on 08/12/2021 and later extended and adjusted validation rules, including updating when validation is triggered and deploying a pre-issuance custom lint to block serialNumber=Government Entity when businessCategory does not equal "Government Entity". GlobalSign also reported re-training of vetting agents and stated that the identified remedial activities concluded, and Mozilla indicated it anticipated closing the case on 19-Jan-2022. The bug is marked RESOLVED with resolution FIXED.

1. 2021-12-03 GlobalSign received an external certificate problem report and began investigating the EV certificate field inconsistency.
2. 2021-12-08 GlobalSign revoked the two identified EV SSL certificates.
3. 2022-01-10 GlobalSign reported completing re-training of vetting agents on the issue.
4. 2022-01-13 GlobalSign deployed a pre-issuance custom lint to prevent the mismatched serialNumber/businessCategory combination.

1. 2021-12-06 GlobalSign nv-sa — GlobalSign stated it had issued two EV SSL certificates with serialNumber "Government Entity" and businessCategory "Private Organization" and said it was investigating and would post a full incident report.
2. 2021-12-10 GlobalSign nv-sa — GlobalSign described how it became aware of the problem, provided a timeline of investigation and response actions (including revocation and halting issuance on the affected profile), and explained the validation-rule failure and remediation work.
3. 2021-12-17 GlobalSign nv-sa — GlobalSign reported extending the validation rule to cover organization level profile fields and said it was on track with the remediation schedule.
4. 2021-12-24 GlobalSign nv-sa — GlobalSign reported updating when the validation rule is triggered so validation happens prior to due diligence checks of the second review.
5. 2021-12-31 GlobalSign nv-sa — GlobalSign reported no scheduled deliverable that week and continued monitoring new requests.
6. 2022-01-07 GlobalSign nv-sa — GlobalSign reported no scheduled deliverable that week and continued monitoring new requests.
7. 2022-01-14 GlobalSign nv-sa — GlobalSign reported re-training of vetting agents and deployment of a pre-issuance custom lint to block serialNumber=Government Entity when businessCategory does not equal "Government Entity," stating remedial activities concluded.
8. 2022-01-15 Mozilla representative — Mozilla stated an expectation to close the bug on Wed 19-Jan-2022.