Sectigo: S/MIME certificates with “(null)” string value in subject attributes

Sectigo reported that, during a manual review of its S/MIME certificate issuance, it noticed certificates issued with the literal string “(null)” in subject:givenName and/or subject:surname attributes. Sectigo stated that, due to certificate profile settings, these subject values could be included in subject:commonName as well. Sectigo traced the issue to an external Identity Provider (IdP) used by an Enterprise RA customer, where missing attribute values were represented as the literal string “(null)”, leading Sectigo systems to issue certificates with bogus subject data. Sectigo developed and deployed a patch to block issuance of any S/MIME certificate where subject:givenName and/or subject:surname are requested to be “(null)”. Sectigo scheduled customer notifications and revocation events, revoking the initially discovered 8 certificates on September 18, 2023 and then identifying a total of 126 affected certificates, with remaining certificates revoked by September 22, 2023. Mozilla staff commented that the bug should be closed as RESOLVED FIXED, and the bug is marked RESOLVED with resolution FIXED.

1. 2023-09-11 Sectigo initiated internal review after noticing S/MIME certificates containing “(null)” in subject attributes.
2. 2023-09-14 Sectigo deployed a patch to block issuance of S/MIME certificates requesting “(null)” subject:givenName and/or subject:surname.
3. 2023-09-18 Sectigo revoked the initially discovered certificates and identified additional affected certificates.
4. 2023-09-22 Sectigo completed revocation of the remaining affected certificates.

1. 2023-09-19 Sectigo — Created the bug describing that manual review found S/MIME certificates with “(null)” in subject:givenName and/or subject:surname, traced it to an IdP connector, deployed a blocking patch, and scheduled customer notifications and revocations.
2. 2023-09-26 Sectigo — Reported that all remaining certificates were revoked by September 22, 2023 and that remediation concluded the investigation.
3. 2023-10-03 Sectigo — Asked the community and Mozilla for opinions on whether the bug should be RESOLVED FIXED or RESOLVED INVALID.
4. 2023-10-08 Mozilla representative — Said the bug should be closed as RESOLVED FIXED rather than RESOLVED INVALID, noting CA responsibility for well-formed certificates.