← DigiCert cases
Bugzilla #1595921 · Certificate Misissuance
DigiCert: Domain validation skipped
DigiCert · RESOLVED
AI Summary
DigiCert reported a significant incident where domain validation was inadvertently skipped during the issuance of 123 OV and 36 EV certificates. This issue arose from a patch applied to a storefront system that bypassed the new domain validation process. The problem was identified during an escape analysis, leading to the revocation of the affected certificates within 24 hours. DigiCert has committed to improving their testing and validation processes to prevent similar incidents in the future.
Chronology
- SEV1 outage reported for storefront
- Problem discovered during escape analysis
- All impacted certificates revoked
Participants
Jeremy Rowley
Ryan Sleevi
Wayne Thayer
External References
Similar Local Cases
DigiCert: "Some-State" in stateOrProvinceName
DigiCert: Internal Domain Name cert mis-issuance
DigiCert: in-addr.arpa Misissuance
DigiCert: Validation Scope Incident
DigiCert: Underscores - CVS Pharmacy
DigiCert: Incorrectly issued EV Certificate
DigiCert: Underscores - Intuit
DigiCert / Swiss Government: CommonName not in SANs