← DigiCert cases
Bugzilla #1914911
Ca Certificate Compliance
DigiCert: Unclear Disclosure of CAA Issuer Domain Names
RESOLVED
FIXED
DigiCert
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
DigiCert opened this case following a report regarding unclear language in their Certificate Policy/Certification Practice Statement (CP/CPS) related to CAA Issuer Domain Names. An investigation revealed that the language suggested the use of domains of the form 'digicert.XX', which was not implemented in their systems. Additionally, it was found that 'symantec.com' had been inadvertently omitted from the list of approved CAA domains, leading to the issuance of 185 misissued certificates. DigiCert revoked these certificates within the required timeframe and updated their CPS to correct the omissions. They have also implemented additional technical reviews and automated checks to prevent similar issues in the future.
Chronology
- DigiCert receives a report about unclear CAA Issuer Domain Names in their CPS.
- All misissued certificates relying on the omitted CAA domain are revoked.
- DigiCert posts a closing summary detailing the incident and remediation steps.
Thread Activity
- Mm representative — Reported unclear language in DigiCert's CPS regarding CAA Issuer Domain Names.
- DigiCert — Confirmed that 185 certificates were misissued due to the omission of 'symantec.com' from the CPS.
- DigiCert — Posted a closing summary detailing the incident and remediation actions.
Participants
Mm representative
DigiCert
External References
Similar Local Cases
DigiCert: Incorrect OrgID in S/MIME certificates for one customer
DigiCert: Late incident report for bug 1925106
DigiCert / Wells Fargo: Invalid DNS names
DigiCert: Verizon mis-issued test certificates
DigiCert: Failure to properly encode Subject name
DigiCert: Issuance of Cert with Compromised Key
DigiCert / Justica: Invalid DNS names
DigiCert: Org information issue in new validation workflow