IdenTrust: EV TLS certificate with invalid jurisdictionStateOrProvinceName for a government entity

IdenTrust disclosed that, during an internal review of CAB Forum EV requirements, it discovered an active EV TLS certificate for a government entity where the certificate’s “jurisdictionStateOrProvinceName” field was included even though the entity updated its registration to operate in other states. The CA stated it received an internal message identifying the discrepancy on 2022-02-11, confirmed the issue was present in one active EV TLS certificate, and made the customer aware of replacement revocation within 5 days. IdenTrust reported that it found four certificates with the issue issued between 2021-12-08 and 2022-01-31, and that the government entity revoked the certificate on 2022-02-16. IdenTrust attributed the problem to a misunderstanding of the requirements for the “Formation State” field and said it had assumed the Maryland headquarters address was correct. To remediate, it reported retraining agents on the Baseline Requirements for government entities and updating the Extended Validation procedure effective 2022-02-17 with a digitally signed, uploaded checklist process requiring a different agent to complete it. The CA stated on 2022-03-01 that it had no other pending activities for the incident, and later confirmed the only remaining item was including it in that year’s WebTrust annual audit report. Mozilla indicated it could be closed on 2022-04-13, and the bug is resolved as FIXED.

1. 2022-02-11 IdenTrust discovered an EV TLS certificate discrepancy involving jurisdictionStateOrProvinceName during an internal compliance review.
2. 2022-02-16 The government entity revoked the affected EV TLS certificate.
3. 2022-02-17 IdenTrust updated its Extended Validation procedure with a new government-entity jurisdiction validation checklist process.
4. 2022-03-01 IdenTrust reported no other pending activities for the incident.
5. 2022-04-13 Mozilla indicated the case could be closed.

1. 2022-02-18 IdenTrust Services, LLC — IdenTrust reported it discovered an active EV TLS certificate with an invalid jurisdictionStateOrProvinceName for a government entity, provided a timeline and certificate details, explained the misunderstanding, and described remediation steps including retraining and an updated EV process effective 2022-02-17.
2. 2022-02-24 IdenTrust Services, LLC — IdenTrust provided crt.sh links for the certificates listed in the recommended format.
3. 2022-03-01 IdenTrust Services, LLC — IdenTrust stated it had no other pending activities for the incident and considered the issue resolved.
4. 2022-03-26 IdenTrust Services, LLC — IdenTrust confirmed there were no other pending activities besides including the incident in that year’s WebTrust annual audit report.
5. 2022-04-11 Mozilla representative — Mozilla said it believed the bug could be closed and would do so on 13-Apr-2022 unless there were important concerns.