SwissSign: 'c/o' in streetAddress of EV certificate

SwissSign reported that, during an internal review of EV certificates on 31 October 2022, it detected eight EV certificates (four “pre” and four “certs”) containing a forbidden “c/o” entry in the “streetAddress” field. The CA stated that its vetting process falsely accepted the invalid values and that its checklists did not clearly forbid “c/o”. SwissSign said it started the mis-issued certificate process, searched for similar false verification on customer-managed PKIs, updated its verification checklists, and changed the configuration of the involved customers. The thread includes CT search links for the affected certificates and notes that the certificates were revoked by the customer on 28 September 2022, with the remaining EV certificate revoked as of 2022-11-04 15:44:33 UTC. SwissSign also reported implementing a technical safeguard to check customer certificate configuration for specific words such as “c/o” and “Postfach” and to forbid their use in EV certificate issuance. Mozilla indicated it would close the bug on or about 2 December 2022 unless additional questions or concerns were raised, and the bug is marked RESOLVED with resolution FIXED.

1. 2022-10-31 SwissSign detected eight EV certificates with a forbidden 'c/o' value in the streetAddress field during an internal review.
2. 2022-11-04 SwissSign revoked the remaining EV certificate (as of 2022-11-04 15:44:33 UTC) and implemented a technical safeguard.
3. 2022-12-02 Mozilla planned to close the bug unless additional questions or concerns were raised.

1. 2022-10-31 SwissSign AG — Mike Guenther described how SwissSign discovered the issue during an internal EV certificate review, provided a timeline of actions (including starting the mis-issued certificate process and updating checklists), and listed CT links for the affected certificates.
2. 2022-11-07 SwissSign AG — Mike Guenther reported that the remaining EV certificate was revoked as of 2022-11-04 15:44:33 UTC and that a technical safeguard was implemented to forbid words such as 'c/o' and 'Postfach' in EV issuance.
3. 2022-11-30 Mozilla representative — Ben Wilson stated Mozilla would close the bug on or about 2-Dec-2022 unless additional questions or concerns were raised.