SSL.com: Issuance of one Sponsored-Validated S/MIME certificate with organization information in givenName and surName of the subjectDN

SSL.com reported a compliance issue regarding the issuance of a Sponsored-Validated S/MIME certificate that incorrectly included organization information in the givenName and surName fields of the subjectDN. This incident was triggered when a subscriber used the bulk order tool incorrectly, leading to a violation of the CA's Certificate Policy. The affected certificate was issued on December 14, 2023, and was revoked shortly after the issue was identified on December 18, 2023. SSL.com has since implemented corrective actions, including updates to the bulk order tool and public documentation to prevent similar occurrences in the future. The case has been resolved with all action items completed.

1. 2023-12-14 A Sponsored-Validated S/MIME certificate was issued with incorrect subject information.
2. 2023-12-18 The certificate was revoked after detection during a routine check.
3. 2024-05-09 All action items related to the incident have been completed.

1. 2023-12-20 SSL.com — SSL.com disclosed the incident and provided a detailed report of the events leading to the misissuance.
2. 2024-01-31 SSL.com — Guidance for bulk-ordering Organization-Validated S/MIME certificates was published.
3. 2024-02-16 SSL.com — A wizard was deployed to guide users through the bulk ordering process.
4. 2024-05-09 SSL.com — SSL.com requested closure of the report after completing all action items.