Firmaprofesional: 2022 SSL certificates issued with wrong Organization ID number

Firmaprofesional reported that, during its annual eIDAS/ETSI audit, it discovered two SSL certificates contained an incorrect Organization ID number that did not match the number in the official records. The CA stated that the evidence was correct, but that a human transcription error occurred when copying the organization identification number (the first digit was not copied). After discovering the issue, Firmaprofesional analyzed additional issued SSL certificates and identified a third certificate with the same error. Firmaprofesional contacted the client about revoking the first two certificates and revoked those certificates on 2022-05-12; it also stated that the third certificate had already been revoked. To prevent recurrence, Firmaprofesional opened a JIRA ticket to develop automated checks and reported uploading a technical control for the Organization Identification Number field to PRE and then to PRO/production, stating it was effective. The CA later indicated that all planned actions had been performed and asked to close the bug; Mozilla responded that it would close it on or about 17-June-2022. The bug is marked RESOLVED with resolution FIXED.

1. 2022-05-10 During the annual eIDAS/ETSI audit, Firmaprofesional discovered two SSL certificates had inaccurate Organization ID information.
2. 2022-05-12 Firmaprofesional revoked the first two affected SSL certificates.
3. 2022-05-15 Firmaprofesional planned to revoke the third affected certificate to comply with the 5-day window.
4. 2022-05-27 Firmaprofesional uploaded a technical control for the Organization Identification Number field to PRE and reported testing before moving it to PRO.
5. 2022-06-02 Firmaprofesional reported the technical control was uploaded to production and considered effective.
6. 2022-06-14 Firmaprofesional requested closure after all planned actions were completed.
7. 2022-06-17 Mozilla indicated it would close the bug on or about this date.

1. 2022-05-13 Autoridad de Certificacion Firmaprofesional — Opened the bug with a timeline describing the audit discovery, the human transcription error, identification of three affected certificates, revocation actions, and plans for automated checks.
2. 2022-05-13 Autoridad de Certificacion Firmaprofesional — Reported that the third certificate had already been revoked.
3. 2022-05-27 Autoridad de Certificacion Firmaprofesional — Reported that the technical control for the Organization Identification Number field was uploaded to PRE for effectiveness testing before moving to PRO.
4. 2022-05-27 Autoridad de Certificacion Firmaprofesional — Repeated the PRE upload and testing statement for the Organization Identification Number field.
5. 2022-06-02 Autoridad de Certificacion Firmaprofesional — Reported the technical control was uploaded to PRODUCTION and stated it was effective.
6. 2022-06-04 Mozilla representative — Asked where the thread explained how the certificates had the wrong organization ID number.
7. 2022-06-06 Autoridad de Certificacion Firmaprofesional — Responded that the CA attributed the issue to human error during transcription (first digit not copied).
8. 2022-06-14 Autoridad de Certificacion Firmaprofesional — Said all planned actions to fix the bug had been performed and asked if it could be closed.
9. 2022-06-14 Mozilla representative — Indicated the bug would be closed on or about Friday, 17-June-2022.