Sectigo: Incomplete Subject organizationName
Sectigo opened this bug to inform Mozilla of an incident involving subject:organizationName values that were incomplete or incorrectly abbreviated in issued certificates. The CA first became aware of the problem via a Certificate Problem Report received on January 23, 2023, identifying 6 certificates issued in 2022 with incomplete subject:organizationName values. Sectigo revoked the initial 6 certificates on January 28, and later revoked additional affected certificates after expanding its investigation, ultimately revoking 253 additional certificates and related certificates as described in the thread. For 18 certificates, affected parties requested an extension of the revocation deadline; Sectigo granted delayed revocation and scheduled those 18 certificates to be revoked before February 22, 2023. Sectigo also stated that no further misissuance had been discovered and that it would monitor its certificate base for non-compliant certificates. The remediation was deployed to production on April 22, 2023, and Sectigo requested closing the bug on May 1, 2023.
- Sectigo received a Certificate Problem Report identifying 6 certificates with incomplete subject:organizationName values.
- Sectigo revoked the initial 6 reported certificates.
- Sectigo completed revocation of 235 certificates and granted delayed revocation for 18 additional certificates.
- Sectigo deployed remediation changes to production systems.
- Sectigo — Sectigo reported that 6 issued certificates were discovered with incomplete subject:organizationName values, that they were revoked on January 28, and that an additional certificate was found with revocation scheduled for January 31.
- Sectigo — Sectigo said further investigation suggested the incident affected more certificates and that it would provide an updated impact assessment and report.
- Sectigo — Sectigo reported that 253 certificates were affected due to incorrectly abbreviated subject:organizationName values and scheduled revocation for February 19.
- Sectigo — Sectigo stated it completed revocation of 235 certificates and granted delayed revocation for 18 certificates after requests for revocation deadline extensions.
- Sectigo — Sectigo provided a detailed incident timeline and explanation in the bug comments/attachment content.
- Sectigo — Sectigo requested a next update for 2023-04-17 while implementing remediation.
- Sectigo — Sectigo reported remediation completion pending QA testing and a target deployment date of April 23.
- Sectigo — Sectigo stated it deployed remediation changes to production on April 22, 2023.
- Sectigo — Sectigo said the issue was remediated with no further questions and requested closing the bug.