← SSL.com cases
Bugzilla #1871113
Self Incident Disclosure
SSL.com: Issuance of one Sponsored-Validated S/MIME certificate with organization information in givenName and surName of the subjectDN
RESOLVED
FIXED
SSL.com
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
SSL.com reported a compliance issue regarding the issuance of a Sponsored-Validated S/MIME certificate that incorrectly included organization information in the givenName and surName fields of the subjectDN. This incident was triggered when a subscriber used the bulk order tool incorrectly, leading to a violation of the CA's Certificate Policy. The affected certificate was issued on December 14, 2023, and was revoked shortly after the issue was identified on December 18, 2023. SSL.com has since implemented corrective actions, including updates to the bulk order tool and public documentation to prevent similar occurrences in the future. The case has been resolved with all action items completed.
Chronology
- A Sponsored-Validated S/MIME certificate was issued with incorrect subject information.
- The certificate was revoked after detection during a routine check.
- All action items related to the incident have been completed.
Thread Activity
- secauditor@ssl.com — SSL.com disclosed the incident and provided a detailed report of the events leading to the misissuance.
- secauditor@ssl.com — Guidance for bulk-ordering Organization-Validated S/MIME certificates was published.
- secauditor@ssl.com — A wizard was deployed to guide users through the bulk ordering process.
- secauditor@ssl.com — SSL.com requested closure of the report after completing all action items.
Participants
secauditor@ssl.com
amir@aaomidi.com
mathew.hodson@gmail.com
bwilson@mozilla.com
External References
Similar Local Cases
SSL.com: Issuance of 3 EV TLS certificates without 2-person validation of the organization information
SSL.com: CAA Empty set handling results in Wildcard issuance
SSL.com: Failure to process CAA records from one SubCA
SwissSign: MPKI step-up process sets wrong JoI Locality
SSL.com: Incorrect Domain Validation for 1 TLS certificate with FQDN having "www." string within domain labels
SSL.com: Issuance of TLS certificates with domain validation methods prohibited by SC-45
SSL.com: Delay in publishing OCSP responses
SSL.com: Wildcard DV certificate issued with a non-validated domain name