DigiCert EV businessCategory case-sensitivity issue and revocation follow-up
DigiCert opened this bug after an internal investigation found that some EV certificates issued in 2023 used lowercase businessCategory strings such as "Private organization" and "Government entity" instead of the exact strings required by the EV Guidelines. The issue was first raised internally after a Sectigo employee mentioned possible case-sensitivity problems in DigiCert’s EV certificates during a personal call on 2024-04-29. DigiCert said the problem affected certificates issued between 2023-09-01 and 2023-12-14, and that it had 10,926 unexpired and unrevoked certificates impacted. DigiCert stated it had fixed the issue in December by adding PKIlint to pre-issuance linting, and that it was revoking all impacted certificates. The thread also notes that a separate delayed revocation bug would cover the revocation timing and replacement issues. By 2024-06-27, DigiCert said all certificates were revoked, and Mozilla indicated the bug would be closed if there were no further questions.
- A Sectigo employee alerted DigiCert to possible case-sensitivity issues in EV businessCategory values.
- DigiCert began issuing some EV certificates with lowercase businessCategory strings instead of the exact required forms.
- The affected issuance period identified by DigiCert ended.
- DigiCert said all affected certificates were revoked.
- Community commenter — DigiCert reported the issue, said it was investigating the scope, and said it would post a full incident report later.
- Google representative — Ryan Dickson said Chrome Root Program viewed the exact EVG strings as case-sensitive and cited DigiCert’s own certificate profile and issuance patterns.
- DigiCert — DigiCert summarized the incident, said the certificates were mis-issued, and said it was revoking 10,926 impacted certificates.
- DigiCert — DigiCert said the remaining work for this bug was mostly complete except for revocation of the remaining certificates.
- Mozilla representative — Mozilla said it had decided the organization labels were required to be case-sensitive.
- DigiCert — DigiCert said all certificates were now revoked and asked whether the bug could be closed.
- Mozilla representative — Mozilla said it intended to close the bug on or about 2024-07-03 if there were no further issues.