← Disig, a.s. cases
Bugzilla #1889672
Certificate Misissuance
Disig: Certificates with incorrect Subject attribute order
RESOLVED
FIXED
Disig, a.s.
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Disig, a Certificate Authority, discovered that it had issued TLS certificates with an incorrect subject attribute order, violating TLS BR Section 7.1.4.2. This issue was identified during an investigation related to a previous bug. Disig promptly notified affected customers and ceased the issuance of TLS certificates until the root cause was determined. By April 9, 2024, all affected certificates had been revoked. Disig implemented a control for subject attribute order to prevent future occurrences and has committed to improving communication with its DevOps and DB teams regarding compliance requirements.
Chronology
- Disig identified certificates with incorrect subject attribute order during an internal investigation.
- All affected certificates were revoked.
- Disig implemented a control for subject attribute order in its certificate issuance process.
Thread Activity
- Disig, a.s. — Preliminary report filed after discovering nonconforming subject attribute order in certificates.
- Disig, a.s. — Final incident report submitted detailing the revocation of affected certificates.
- Disig, a.s. — Control for subject attribute order implemented successfully.
Participants
Disig, a.s.
Sectigo
HARICA
Mozilla representative
External References
Related Bugzilla IDs Mentioned
Similar Local Cases
Disig: TLS certificate with basicConstraints not marked as critical
Disig: Certificates with invalid embedded SCT signature
Disig: Two certificates with same serial number
IdenTrust: unintended creation of a Root CA certificate
Disig: Non-BR-Compliant Certificate Issuance
Asseco DS / Certum: TLS EV certificates with incorrect Subject attribute order
Sectigo: Certificate issuance delayed for more than 398 days after DCV was completed
iTrusChina: Issuance of certificates using keys previously reported as compromised