Sectigo: Misspelled city name in localityName field
Sectigo reported that its internal audit discovered a replacement certificate containing a misspelled subject:localityName value. The incorrect value was “Las Angeles” instead of the correct spelling “Los Angeles,” and Sectigo confirmed the certificate was misissued. Sectigo notified the subscriber that the certificate was scheduled for revocation and then revoked the affected certificate on July 19, 2022. As remediation, Sectigo stated it is phasing out the localityName subject attribute in public certificates due to the difficulty of preventing human error in an open text field. Sectigo also described additional process changes to strip out the localityName field during replacement requests, with development scoped and a deployment date targeted. Sectigo reported that the changes were deployed on September 25, 2022, and that only a very limited number of pre-approved subscribers could still issue certificates including subject:localityName, with deprecation planned for 2023. Mozilla indicated it would close the bug on 10/5/2022 unless additional issues or questions arose, and the bug is marked RESOLVED with resolution FIXED.
- Internal audit identified a replacement certificate containing an incorrect subject:localityName value (“Las Angeles”).
- Sectigo notified the subscriber that the misissued certificate was scheduled for revocation.
- The affected certificate was revoked.
- Sectigo deployed process changes to deprecate/remove the localityName field from certificates.
- Sectigo — Sectigo explained that internal audit found a misissued replacement certificate with misspelled localityName (“Las Angeles” vs “Los Angeles”), confirmed the misissuance, notified the subscriber, and revoked the certificate.
- Sectigo — Martijn Katerbarg stated the investigation was concluded and Sectigo would monitor the bug for questions.
- Mozilla representative — Ben Wilson asked Sectigo to clarify the specific next actions and timeline for remediation tracking.
- Sectigo — Martijn clarified remediation steps: ongoing removal of localityName from new certificates, a new replacement-process change to strip the field, and multi-person approval for any limited exceptions.
- Sectigo — Martijn targeted deployment by end of September and requested a next-update date of September 30.
- Sectigo — Martijn reported the changes were deployed on September 25 and that only a limited set of pre-approved subscribers could still issue localityName-containing certificates.
- Mozilla representative — Ben Wilson said he would close the bug on 10/5/2022 unless additional issues or questions appeared.