GlobalSign: EV TLS certificate with only metadata in JOI State field
GlobalSign reported that it issued an EV TLS certificate where the jurisdictionStateOrProvinceName field contained only metadata. The issue was triggered by a report received by GlobalSign’s r**********e@globalsign.com email address on 24/08/2023 09:01 UTC, which GlobalSign escalated to its internal SOC and Compliance team. GlobalSign confirmed the certificate in the report required revocation and initiated a revocation and replacement process, including review of outstanding requests and historically issued valid certificates. GlobalSign stated it had no additional historically issued certificates or outstanding requests affected by the issue, and it put vetting management on high-alert with monitoring reports for incoming requests. As remediation, GlobalSign deployed an extended post-issuance linter on 24/08/2023 and later deployed a pre-issuance custom lint on 26/10/2023 to prevent the problem from recurring. The bug was marked RESOLVED with resolution FIXED, and GlobalSign indicated the remedial activities were concluded unless further questions remained.
- GlobalSign issued the EV TLS certificate later reported as having only metadata in the jurisdictionStateOrProvinceName field.
- GlobalSign received a report about the problematic EV TLS certificate and began investigation and revocation/remediation actions.
- GlobalSign revoked the affected certificate by 29 August 2023 09:00 UTC at the latest.
- GlobalSign deployed a pre-issuance custom lint to check for required unicode character categories.
- GlobalSign nv-sa — Reported steps to reproduce, said GlobalSign was working with the customer to replace the certificate, and stated it would be revoked by 29 August 2023 09:00 UTC at the latest while root-cause analysis proceeded.
- GlobalSign nv-sa — Described how GlobalSign became aware (r**********e@globalsign.com), provided a timestamped timeline of escalation, investigation, revocation/replacement initiation, reviews of outstanding and historical certificates, monitoring setup, and linter deployment.
- GlobalSign nv-sa — Stated there were no scheduled deliverables that week and that monitoring of new requests continued.
- GlobalSign nv-sa — Said pre-issuance lint would be deployed by 29/09/2023 (one week later than initially planned) and that monitoring of new requests continued.
- GlobalSign nv-sa — Announced deployment of the pre-issuance custom lint on 26/10/2023 09:20 UTC and stated this concluded the remedial activities unless further questions remained.