Certigna: Precertificate with a validity period greater than 398-days

The case reports that Certigna issued a precertificate with a validity period greater than 398 days. The reporter identified the specific precertificate on crt.sh and noted that it exceeded the expected validity limit. Certigna responded that it launched internal investigations to determine the origin of the 400-day validity issuance, stating the issue appeared linked to a specific certificate renewal that had not been corrected by its automatic verification scripts. Certigna confirmed that only this certificate was affected, that revocation actions had been initiated, and that the incident had been communicated to CA and RA teams while awaiting investigation results and corrective actions. Certigna also stated it would create a detailed bug report within 24 hours and report the incident to its assessment and supervisory bodies. The bug was later marked as a duplicate of bug 1774418.

1. 2022-06-14 Certigna issued a precertificate with a validity period of about 400 days (greater than 398 days).
2. 2022-06-15 Certigna created a new Bugzilla report (bug 1774418) to provide more details on the incident’s origin and corrective actions.
3. 2022-07-15 This bug was marked as a duplicate of bug 1774418.

1. 2022-06-14 Lebihan representative — Reported finding a Certigna precertificate on crt.sh with a validity period greater than 398 days.
2. 2022-06-14 Sectigo — Asked why the issue happened again, referencing a prior incident report where Certigna said certificates would not be issued with validity greater than 397 days.
3. 2022-06-14 Dhimyotis representative — Said Certigna launched internal investigations, indicated the issuance seemed linked to a renewal not corrected by automatic verification scripts, and confirmed only one certificate was affected, revocation was initiated, and CA/RA teams were informed while awaiting corrective actions.
4. 2022-06-15 Dhimyotis representative — Created bug 1774418 to report the incident with more details on origin and corrective actions.
5. 2022-07-15 Mozilla representative — Marked this bug as a duplicate of bug 1774418.