SwissSign: EV code in JurisdiktionStateOrProvinceName
SwissSign reported an internal compliance incident involving EV certificate contents. An internal employee raised a question about the EV jurisdictionStateOrProvinceName field, and SwissSign’s product manager determined that SwissSign used ISO 3166-2 codes instead of the full state/province name required by EV Guidelines chapter 9.2.4. SwissSign’s compliance team confirmed the non-compliance, ordered a stop to EV certificate issuance, compiled a list of affected certificates, and began informing affected customers while informing the audit body. SwissSign identified the root cause as a change made in 2020-06-05 to use ISO 3166-1/2 codes for country and state fields, and then reviewed, tested, and deployed an emergency fix that referenced the state/province name instead of its code; EV issuance was resumed. SwissSign stated that it issued 6,176 certificates with ISO 3166-2 in the EV jurisdiction fields since 2020-06-05, and at the time of posting (2023-10-20) there were 2,505 valid certificates. The incident actions included notifying customers to replace affected certificates by 2023-10-27 23:59 (CEST) and revoking any still-valid affected EV certificates by 2023-10-28 06:00 UTC; the bug was resolved as FIXED, with remaining tasks handled in Bugzilla 1861682.
- SwissSign implemented a change to use ISO 3166-1/2 codes for country and state fields in EV-related processes.
- A SwissSign internal employee raised a question about the EV jurisdictionStateOrProvinceName field content.
- SwissSign discovered EV Guidelines non-compliance and raised a compliance incident, stopping EV issuance.
- SwissSign deployed an emergency fix and resumed EV certificate issuance; the bug was posted.
- SwissSign planned to revoke any still-valid affected EV certificates by this time.
- Mozilla closed the bug after it was marked RESOLVED.
- SwissSign AG — Created the incident report attachment, stating that SwissSign used ISO 3166-2 codes instead of full jurisdiction names required by EV Guidelines 9.2.4, and described the stop/resume issuance and planned revocation/replacement actions.
- HARICA — Questioned whether EV Guidelines 9.2.4 strictly requires full names for JOIstateOrProvinceName and suggested checking real-world values.
- SwissSign AG — Quoted EV Guidelines 9.2.4 language stating the jurisdiction information MUST use the full name.
- HARICA — Agreed and suggested discussing whether known abbreviations documented in ISO could be allowed in the CA/B Forum SCWG.
- SwissSign AG — Supported the discussion and referenced action item #4.
- SwissSign AG — Created an additional Bugzilla due to delayed revocation of 40 certificates (Bugzilla 1861682).
- Google representative — Requested improvements to the Impact and Actions Items sections and asked whether SwissSign considered preventative technical controls such as linting.
- SwissSign AG — Updated the report with certificate impact counts and revised action item classifications, and discussed why an additional linter was not expected to improve robustness.
- SwissSign AG — Stated there is no further action planned for this Bugzilla and that remaining tasks are handled in Bugzilla 1861682, asking to close if no further questions.
- Mozilla representative — Indicated he would close the bug on 2023-11-08 unless further discussion was needed.