DigiCert: Certificates issued inconsistent with S/MIME BR v1.0.1
DigiCert reported that it became aware on 21 October 2023 UTC that it had issued a small number of S/MIME certificates that were not compliant with the current S/MIME Baseline Requirements (S/MIME BR v1.0.1). DigiCert stated that its linter alerted it to two issues: (1) a certificate enrolled with an “=” in the email address was miss-formatted when copied to the SAN due to an added escape “\” character, and (2) the AIA CAIssuers value for a single account was entered incorrectly due to a typo in an ICA configuration file. DigiCert confirmed the issues, updated configuration and code to remove the escape character being added, and revoked affected certificates in two batches. DigiCert also updated the AIA profile and stated that pre-issuance linting would be in place by 21 December. In a later update, DigiCert said it integrated PKILint as a pre-issuance linter and that it had been running for two days and working as expected. Mozilla indicated it would close the item unless there were objections, and the bug is marked RESOLVED with resolution FIXED.
- DigiCert became aware it had issued a small number of S/MIME certificates not compliant with S/MIME BR v1.0.1.
- DigiCert confirmed the SAN escape-character issue and the AIA CAIssuers misconfiguration issue.
- DigiCert updated code to remove the escape character and began remediation actions.
- DigiCert revoked the first batch of AIA-related certificates.
- DigiCert revoked additional certificates and updated the AIA profile.
- DigiCert reported PKILint integration and that pre-issuance linting was running and working as expected.
- Community commenter — Reported that DigiCert became aware on 21 Oct 2023 that it issued a small number of non-compliant S/MIME certificates and said it was investigating and remediating with an update expected by 30 Oct.
- Mozilla representative — Noted the new incident reporting template and linked to the CCADB incident-report template page.
- Community commenter — Provided reproduction steps, impact (8 certificates total across 2 customers), timeline, root cause analysis, and action items including pre-issuance linting by 21 Dec.
- Community commenter — Asked whether Mozilla wanted to close the case or set a next update for 21 Dec when pre-issuance linting would be in place.
- Mozilla representative — Said Mozilla would set it for December to hear about DigiCert’s implementation of pre-issuance linting.
- Community commenter — Reported that PKILint was integrated as the pre-issuance linter, running for two days and working as expected, and asked if Mozilla was okay to close.
- Community commenter — Stated DigiCert was monitoring the case if there were any questions.
- Mozilla representative — Indicated that unless there were objections, Mozilla would close the item on 3 Jan 2024.