Sectigo: Incorrect JOI Country value
Sectigo reported that it received an email about a certificate with a seemingly incorrect subject:jurisdictionCountryName value. Sectigo’s investigation determined that a certificate issued on February 8, 2021 was misissued due to a software error in its automated system that failed to update the subject:jurisdictionCountryName field after order information was changed. The certificate was validated through Sectigo’s legacy validation system from Xolphin, which Sectigo acquired in 2020, and Sectigo stated that it continued to use those legacy systems for validation at the time. Sectigo planned and scheduled a revocation for December 21, 2021, informed the impacted customer, and created an SSL Abuse ticket based on the reporter’s email. Sectigo also updated the Xolphin validation system by completing development and QA on tickets to add a critical warning for subject:jurisdictionCountryName mismatches and to update the subject:jurisdictionCountryName field when a different QGIS is selected. Sectigo performed final scans and found no additional affected certificates, and then revoked the misissued certificate on December 21, 2021. The bug was resolved as FIXED, and Sectigo requested closing the bug after monitoring for questions.
- A certificate was issued with an incorrect subject:jurisdictionCountryName value.
- Sectigo identified the misissued certificate after receiving external reports and began internal investigation.
- Sectigo revoked the misissued certificate and completed remediation on the legacy validation system.
- Mozilla indicated it would close the bug.
- Sectigo — Sectigo described how it became aware of the issue, identified the misissued certificate, scheduled and performed revocation, and documented remediation steps to the legacy Xolphin validation system.
- Sectigo — Sectigo stated its investigation and remediation were concluded and that it would monitor the bug for questions.
- Sectigo — Sectigo noted there were no comments and requested closing the bug.
- Mozilla representative — Mozilla said it would close the bug on Friday, 14-Jan-2022.