SwissSign: difference in upper and lower case between CN field and SAN

SwissSign identified a compliance issue involving 44 certificates where there was a discrepancy between the Common Name (CN) field and the Subject Alternative Name (SAN). This issue was reported by Ben Wilson, prompting an internal investigation that confirmed the mis-issuance. All affected certificates were revoked within seconds of detection. The root cause was traced to a bug in the issuance workflow that allowed the issuance process to continue despite failed pre-issuance checks. SwissSign has since implemented a fix and established an automatic alarm system to trigger the internal mis-issuance process in future incidents. The case is now resolved.

1. 2023-05-08 Implementation of the Update that introduced the bug
2. 2023-06-09 First mis-issued certificate detected
3. 2023-09-15 Last mis-issued certificate detected
4. 2024-01-10 Incident reported by Ben Wilson
5. 2024-01-11 SwissSign confirms mis-issuance and starts remediation process
6. 2024-02-20 Fix for the bug implemented
7. 2024-03-19 Automatic alarm for mis-issuance process successfully implemented

1. 2024-01-11 SwissSign AG — Created attachment with a list of affected certificates and initiated the incident report.
2. 2024-01-16 SwissSign AG — Updated with results from ongoing investigation showing no further certificates impacted.
3. 2024-02-21 SwissSign AG — Confirmed that the bug fix passed quality process and was implemented.
4. 2024-03-21 SwissSign AG — Announced successful implementation and testing of the automatic alarm for mis-issuance.
5. 2024-03-22 Mozilla representative — Indicated intention to close the bug unless further discussion is needed.