SwissSign: S/MIME NCP non ASCII symbols in email and SAN field wrong coding

SwissSign AG reported a compliance issue regarding S/MIME NCP certificates, where non-ASCII characters were incorrectly coded in the Subject Alternative Name (SAN) field, violating S/MIME BR 7.1.2.4. This issue was discovered during an annual audit, prompting the CA to initiate a mis-issuance process to revoke the affected certificates. A total of 194 certificates were identified as impacted, with revocation completed by August 23, 2024. The CA has implemented measures to prevent future occurrences, including the activation of a linter to catch such errors. Ongoing updates regarding the root cause analysis and lessons learned are being documented.

1. 2023-12-02 First mis-issuance of affected S/MIME NCP certificates.
2. 2024-02-20 Last mis-issuance of affected S/MIME NCP certificates.
3. 2024-08-23 Revocation of all affected certificates completed.

1. 2024-08-20 SwissSign AG — Created a preliminary incident report detailing the mis-coding of non-ASCII characters in SAN fields.
2. 2024-08-21 SwissSign AG — Provided an updated list of affected certificates after addressing feedback on the initial report.
3. 2024-08-23 SwissSign AG — Confirmed the completion of revocation for all affected certificates.
4. 2024-09-06 SwissSign AG — Announced the completion of test-coverage inclusion for non-ASCII characters.
5. 2024-09-06 Mozilla representative — Scheduled the matter for closure.