SwissSign: MPKI step-up process sets wrong JoI Locality

RESOLVED FIXED SwissSign AG

This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update. Always refer to the official Bugzilla thread as the authoritative source. If you spot an inaccuracy, let me know via the contact form.

AI Summary

SwissSign AG reported a mis-issuance of 18 Extended Validation (EV) certificates due to incorrect Jurisdiction of Incorporation (JoI) locality fields during an audit walkthrough of their MPKI step-up process. The issue was discovered on April 29, 2024, and all affected certificates were revoked. The CA assessed the risk to the ecosystem as low since the mis-issued certificates were not in productive use. SwissSign has implemented corrective actions to prevent future occurrences, including enhancing their testing procedures and ensuring proper checks are in place for automated changes to customer data. The case has been resolved with all action items completed.

Model: gpt-4o-mini Generated: 2026-06-13 20:49 UTC Revised: 2026-06-16 18:21 UTC Confidence: 0.90 14 comments

Chronology

2024-04-29 Discovery of mis-issued certificates during audit review
2024-05-17 Correction of error in the step-up process completed

Thread Activity

2024-04-29 SwissSign AG — Reported the mis-issuance of 8 EV certificates with wrong JOI locality fields.
2024-05-03 SwissSign AG — Identified an additional 10 mis-issued certificates.
2024-05-10 SwissSign AG — Provided an updated analysis of the incident and confirmed a total of 18 mis-issued certificates.
2024-06-14 SwissSign AG — Reported that all action items have been completed and requested closure of the Bugzilla.

Participants

SwissSign AG Community commenter Mozilla representative

External References

Original Bugzilla Case

Similar Local Cases

#2033000 RESOLVED Ca Certificate Compliance Incident Self Reported Incident Policy Document Issue Opened 2026-04-17 · Closed 2026-07-09 · 100% similar

SwissSign: Certificate Profile error for S/MIME MV

AI Summary CA Owner

#1914020 RESOLVED Certificate Misissuance Revocation Issue Opened 2024-08-20 · Closed 2024-09-13 · 100% similar

SwissSign: S/MIME NCP non ASCII symbols in email and SAN field wrong coding

AI Summary CA Owner

#1815466 RESOLVED Revocation Issue Self Reported Incident Opened 2023-02-07 · Closed 2023-04-19 · 95% similar

SwissSign: CRL/OCSP revocation time mismatch

AI Summary CA Owner

#1849364 RESOLVED Revocation Issue Self Reported Incident Opened 2023-08-18 · Closed 2023-09-22 · 95% similar

SwissSign: Missed revocation and opening Bugzilla

AI Summary CA Owner

#1897346 RESOLVED Certificate Misissuance Revocation Issue Opened 2024-05-17 · Closed 2024-07-24 · 93% similar

SECOM: Difference in upper and lower case between CN field and SAN

AI Summary CA Owner

#1848854 RESOLVED Certificate Misissuance Self Reported Incident Opened 2023-08-15 · Closed 2024-03-27 · 92% similar

SwissSign: S/MIME LCP: CN with values other than email address

AI Summary CA Owner

#1890685 RESOLVED Revocation Issue Certificate Misissuance Opened 2024-04-09 · Closed 2025-02-21 · 91% similar

Entrust: Failure to revoke EV TLS certificates issued before CPS update

AI Summary CA Owner

#1731586 RESOLVED Ca Certificate Compliance Self Reported Incident Certificate Misissuance Opened 2021-09-20 · Closed 2023-02-22 · 91% similar

SwissSign: Certificate with key length 16258

AI Summary CA Owner