SwissSign: EV JurisdictionStateOrProvinceName - one certificate not selected for revocation

This case describes an EV certificate misissuance by SwissSign where the jurisdictionStateOrProvinceName field used a code instead of the full name. The issue occurred after a fix was implemented for Bugzilla 1860750, but one certificate was not selected for revocation because the certificate request was still in a "domain validation pending" state. After the customer completed domain validation, the certificate was issued with the code rather than the full jurisdictionStateOrProvinceName. SwissSign’s internal self-audit identified the mis-issued certificate, Compliance confirmed the misissuance, and the affected customer and audit body were informed. The affected certificate was revoked by the customer, and SwissSign completed checks to ensure no other pending certificate requests had wrong information. SwissSign updated internal process documentation for mass-revocation and clarified with the vendor of the CA system that other states or border cases need to be considered. The bug was resolved as FIXED and was closed by Mozilla after no further questions were raised.

1. 2023-10-20 SwissSign internal employee raised a question about EV jurisdictionStateOrProvinceName field, leading to Bugzilla 1860750 being created.
2. 2023-11-21 SwissSign developer working on an updated self-audit script noticed the mis-issued EV certificate.
3. 2023-11-22 SwissSign Compliance confirmed the misissuance and initiated the misissuance process, including revocation of the affected certificate.
4. 2023-11-29 SwissSign reported completion of vendor clarification and update to internal mass-revocation process documentation.
5. 2023-12-06 Mozilla closed the bug after confirming no further questions or concerns.

1. 2023-11-22 SwissSign AG — Opened an incident report explaining that one EV certificate was mis-issued with a jurisdictionStateOrProvinceName code and was not selected for revocation due to a pending domain validation state.
2. 2023-11-29 SwissSign AG — Reported that clarification with the CA system vendor was completed and internal mass-revocation process documentation was updated.
3. 2023-12-06 SwissSign AG — Asked whether there were any open questions and requested closing the bug.
4. 2023-12-06 Mozilla representative — Stated intent to close the bug on 8-Dec-2023 unless there were concerns.