DigiCert: Org-JOI type mismatch (two misissued EV certificates)
This case concerns two DigiCert certificates issued with improper JOI information, where the organizational type did not match the registration number convention. The issue was initially raised when Pedro Fuentes from Wisekey contacted DigiCert’s Revocation Report alias about a certificate with improper JOI information. DigiCert investigated and identified two instances of misissuance in which JOI registration types and serial numbers were mixed, with both affected certificates issued on March 22, 2023. DigiCert deployed an engineering fix on April 5, 2023 to prevent validation agents from entering “Government Entity” when the selected organization type is not “Government Entity,” and to tie the organization type and registration number together so they cannot be manually overridden. DigiCert began the revocation process on April 6, 2023 and revoked the two identified certificates on April 11, 2023. The bug was resolved as FIXED, and DigiCert stated it updated systems to prevent additional issuance with incorrect information.
- Wisekey contacted DigiCert’s revocation report alias about a certificate with improper JOI information.
- DigiCert deployed a fix to prevent mismatched JOI organization type and registration number during validation.
- DigiCert revoked the two identified certificates impacted by the JOI mismatch.
- DigiCert — Jeremy Rowley described the misissuance findings, the investigation timeline, the April 5 system fix, and that two certificates were revoked on April 11; he also provided CT/sha256 links for the affected certificates.
- Community commenter — Mathew Hodson asked which certificate was reported on March 25 and whether it should have been revoked by March 30.
- DigiCert — Jeremy Rowley clarified that neither certificate was reported on March 25 and that both were found via internal investigation after a false positive certificate problem report.
- DigiCert — Jeremy Rowley asked whether there were additional questions and suggested closing the bug.
- Mozilla representative — B. Wilson stated they would close the bug on or about Wed 3-May-2023 unless other issues remained.