SwissSign: Invalid CT data in issued certs (SABRE.CT misconfiguration)

SwissSign AG reported an issue regarding invalid Certificate Transparency (CT) data in some of their issued certificates due to a misconfiguration in their SABRE.CT system. The problem was identified after an employee noticed a mention of SwissSign in a blog post about CT issues. Following the discovery, the compliance team opened an incident and confirmed the misissuance of four certificates. Although the certificates contained SCTs from a test log, they complied with existing policies, leading to the resolution of the case as 'Invalid'. The CA has since ceased the issuance of affected certificates and is implementing measures to prevent future occurrences.

1. 2023-03-28 Internal compliance incident opened after employee report.
2. 2023-03-29 Incident report published and affected customers contacted.
3. 2023-04-01 Revocation of affected certificates scheduled.