SwissSign: RAO field modifications not saved, causing mis-issuance of OV certificates

SwissSign reported that during a review of its new web shop integration, it discovered that during the RAO check, modifications to regulated fields (Organization and State) were not saved into issued certificates. SwissSign stated this led to mis-issued certificates with wrong contents, affecting 11 precerts and 11 OV TLS certificates issued since 22 December 2023. After confirming the mis-issuance, SwissSign stopped RAO approval for certificates ordered via the web shop during the internal investigation and then resumed issuance once correct issuance was ensured. SwissSign identified a bug in the OV RAO approval process and mitigated it by exchanging the OV RAO process with the EV process, resulting in a fully compliant RAO process. SwissSign later updated the case to state that all affected certificates were revoked and that no further action was planned if there were no further community questions. Mozilla indicated it would keep the bug open for discussion until 7 February 2024.

1. 2023-12-22 SwissSign began issuing OV TLS certificates affected by the RAO field-saving problem in the new web shop integration.
2. 2024-01-25 SwissSign received an internal report during review of the new web shop integration that field modifications were not saved into certificates during the RAO check.
3. 2024-01-30 SwissSign reported that all affected certificates had been revoked and updated the bug timeline.

1. 2024-01-26 SwissSign AG — Created the incident report stating that RAO-modified Organization and State fields were not saved into certificates, resulting in mis-issuance of 11 precerts and 11 OV TLS certificates, and described mitigation by switching the OV RAO process to the EV process.
2. 2024-01-30 SwissSign AG — Updated the case to say all certificates were revoked, corrected a timeline typo, and stated no further action was planned if there were no further community questions.
3. 2024-01-30 Mozilla representative — Said the bug would remain open for another week until 7 February 2024 in case of further discussion.