SwissSign: S/MIME LCP: CN with values other than email address

SwissSign AG reported a mis-issuance incident involving S/MIME certificates where the Common Name (CN) contained values other than email addresses. The issue was first identified on August 14, 2023, when a customer alerted SwissSign's support team. Following the discovery, SwissSign took immediate action to halt further mis-issuances and began revoking affected certificates. A total of 300 mis-issued certificates were identified, with revocation completed by August 20, 2023. SwissSign has implemented a series of remediation steps, including root cause analysis and the introduction of a new S/MIME linter to prevent future occurrences. The case is now resolved, with all necessary actions taken and improvements in place.

1. 2023-08-14 Customer reported issue with mis-issued S/MIME certificates.
2. 2023-08-20 All affected certificates were revoked.
3. 2024-02-21 External S/MIME linter was implemented.

1. 2023-08-15 SwissSign AG — Reported the mis-issuance incident and outlined the timeline of actions taken.
2. 2023-08-17 SwissSign AG — Provided updates on remediation steps and confirmed revocation timeline.
3. 2024-02-21 SwissSign AG — Confirmed that the patch to include the external S/MIME linter is now in production.
4. 2024-03-25 Mozilla representative — Indicated that remediation of the issue is complete and planned to close the bug.