← SwissSign AG cases
Bugzilla #1766255
Certificate Misissuance
SwissSign: Mis-Issuance of S/MIME certificates
RESOLVED
FIXED
SwissSign AG
AI Summary
SwissSign AG reported a mis-issuance of S/MIME certificates due to the deletion of an end-user profile from their published Certificate Policy (CPR). This issue was identified during an internal audit on April 25, 2022, leading to the revocation of 140,894 affected certificates. The CA took immediate steps to correct the error by republishing the CPR and revoking the mis-issued certificates by April 30, 2022. All remediation steps have since been completed, and the CA has implemented process improvements to prevent future occurrences.
Chronology
- Internal audit revealed mis-issuance of certificates.
- All mis-issued certificates revoked.
- Process improvements implemented.
Participants
Mike Guenther
Ben Wilson
External References
Similar Local Cases
SwissSign: Misissuance with mispellings in Location for a number of Certificates
SwissSign: Certificate with key length 16258
SwissSign: S/MIME LCP: CN with values other than email address
SwissSign: Certificate with key length 4098 bit
SwissSign: S/MIME LCP not-permitted key usage
SwissSign: Misissuance of Intermediate Certificates because of incorrect organizationIdentifier
SwissSign: S/MIME certificates deviate from CPR
SwissSign: wrong address in EV certificate