← Sectigo cases
Bugzilla #1897538
Certificate Misissuance
Sectigo: Incorrectly included registrationStateOrProvince in PSD-based cabfOrganizationIdentifier extension
RESOLVED
FIXED
Sectigo
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
On May 15, 2024, Sectigo was informed of potentially misissued QWAC PSD2 TLS certificates. Upon review, they identified one certificate as misissued due to the incorrect inclusion of 'registrationStateOrProvince' in the cabfOrganizationIdentifier extension. Sectigo halted issuance of such certificates and initiated an investigation, confirming one additional misissued certificate. They have since developed a patch to correct the issue and scheduled a revocation for the affected certificates. An incident report was shared, and Sectigo is working on clarifying the cabfOrganizationIdentifier extension language in future guidelines.
Chronology
- Sectigo received a report of potentially misissued certificates.
- Sectigo confirmed an additional misissued certificate.
- Sectigo committed to providing a complete incident report.
- Sectigo opened a PR to address the incident.
Thread Activity
- Sectigo — Sectigo received a call about potentially misissued certificates.
- Sectigo — Sectigo provided a detailed incident report.
- Sectigo — Sectigo acknowledged the need for clarity in their practices.
- Sectigo — Sectigo requested to close the bug after addressing action items.
Participants
Sectigo
Google representative
Apple representative
Mozilla representative
External References
Similar Local Cases
Sectigo: Certificate issuance delayed for more than 398 days after DCV was completed
Sectigo: S/MIME certificates with (null) string value in subject attributes
Sectigo: SMIME issuance with insufficient validation of mailbox authorization or control
Sectigo: Failure to block disallowed LDH labels in domain names
Sectigo: SC45 DCV Reuse Error
Sectigo: Subject field with unvalidated information included in certificates
Sectigo: Invalid postalCode field
Sectigo: Invalid stateOrProvinceName