Sectigo: Missing character in subject:organizationName attribute value
Sectigo received a Certificate Problem Report (CPR) from an external party on 2024-07-26 reporting three certificates for the same Subscriber that were missing a single character in the subject:organizationName attribute value. The organization name was expected to include two “l”’s, but was included with one, and a later CPR reported additional certificates with the organization suffix misspelled as “Limted” instead of “Limited”. Sectigo investigated, confirmed the certificates were misissued, and scheduled revocation events for the reported certificates. On 2024-07-31, Sectigo revoked the three initially reported certificates, and after receiving the follow-up CPR, it scheduled and performed revocation of seven additional misissued certificates on 2024-08-07. Sectigo’s incident report describes the root cause as a validation process that did not catch the typographical errors in the customer-provided organization name and notes limited automation coverage for the sources used. The bug was requested to be closed after monitoring, and Mozilla indicated it intended to close it on or about 21-Aug-2024 unless further comments were received. The bug is currently marked RESOLVED with resolution FIXED.
- Sectigo received an external Certificate Problem Report about misissued certificates with subject:organizationName typos.
- Sectigo revoked the three initially reported misissued certificates.
- Sectigo received a follow-up Certificate Problem Report about additional misissued certificates with subject:organizationName typos.
- Sectigo revoked seven additional misissued certificates.
- Sectigo — Posted a preliminary incident report stating that three certificates were reported missing a character in subject:organizationName and that revocation was scheduled for 2024-07-31, with a full report due by 2024-08-09.
- Sectigo — Submitted the incident report detailing the two CPRs, the impact (10 affected certificates), confirmation of misissuance, revocation of the 3 certificates on 2024-07-31 and the 7 certificates on 2024-08-07, and root cause/lessons learned and an action item.
- Sectigo — Noted that Sectigo was monitoring the incident for questions or comments.
- Sectigo — Requested closing the bug because there were no questions or comments.
- Mozilla representative — Indicated intent to close the bug on or about 21-Aug-2024 unless additional comments or questions were raised.