certSIGN: Certificates with incorrect Subject attribute order
certSIGN reported that it had issued 625 TLS certificates since September 15, 2023 with an incorrect relative order of Subject attributes, as defined in BR section 7.1.4.2. The issue was triggered by a Certificate Problem Report received on March 18, 2024 indicating a non-conformity in Subject Attribute Encoding order. After acknowledging the report, certSIGN stopped issuance of all TLS certificates, corrected the Subject attribute order, and restarted issuance. certSIGN stated that it would revoke all affected certificates and later reported that it revoked and reissued all affected certificates. certSIGN also informed its WebTrust auditors about the incident and deployed a new update in production. In response to Mozilla’s question about preventing recurrence, certSIGN described improvements to its linter update and testing processes, including periodic checks and additional internal auditor review. The bug is marked RESOLVED with resolution FIXED, and a later comment notes that Bug 1965807 was marked as a duplicate of this bug.
- certSIGN stopped TLS certificate issuance after identifying an incorrect Subject attribute order and began correcting the issue.
- certSIGN deployed an update to production and restarted TLS certificate issuance.
- certSIGN revoked and reissued all affected certificates.
- certSIGN reported completion of reviewed testing steps and closure of action items.
- Mozilla indicated intent to close the bug unless further comments or questions were received.
- CCADB incident reporting marked Bug 1965807 as a duplicate of this bug.
- certSIGN — Created an incident report stating certSIGN issued 625 TLS certificates with incorrect Subject attribute order, stopped issuance on March 18, corrected the order, restarted issuance, and planned to revoke affected certificates.
- certSIGN — Reported that certSIGN revoked and reissued all affected certificates.
- certSIGN — Stated the software update testing process was reviewed and that all action items were closed.
- certSIGN — Reiterated that the testing process review was completed and that all action items are closed.
- Mozilla representative — Asked what actions would ensure certSIGN linter(s) stay up to date with future certificate profile requirements.
- certSIGN — Described continuous monitoring of CA/B Forum ballots/guideline versions, added monthly periodic checks, and added quarterly internal auditor review of linters.
- Mozilla representative — Said Mozilla intended to close the bug next Wednesday (2024-06-05) unless additional comments or questions were received.
- CCADB representative — Noted that Bug 1965807 was marked as a duplicate of this bug.