Asseco Data Systems / Certum: S/MIME misissuance due to Organization Identifier and Country field discrepancies

Asseco Data Systems S.A. (Certum) reported a self-identified incident in which several S/MIME certificates were issued with discrepancies between the Organization Identifier and Country fields. The incident affected 4 certificates (1 S/MIME Organization and 3 S/MIME Sponsor). The issue was discovered during a scan that identified similar discrepancies in 6 certificates, with 2 already revoked. The CA stated that the root causes included initial validator limitations (the validator did not check that the Country in the OrganizationIdentifier matched the Country code) and confusion between similar country names. The CA revoked the mis-issued certificates within the required 5-day period, with the last mis-issued certificate revoked on 2024-09-13. To prevent recurrence, the CA implemented linting for S/MIME certificates, improved the mechanism for generating OrganizationIdentifiers, updated training for validation officers, and deployed an interface change to add ISO Country Codes next to country names. The bug thread indicates all listed action items were completed and the CA continued monitoring; Mozilla planned to close the bug if no further questions were raised.

1. 2023-09-18 An incident involving S/MIME certificates with incorrect OrganizationIdentifier was created.
2. 2023-12-14 A validator for the OrganizationIdentifier field was implemented.
3. 2023-12-27 Mis-issuance of three S/MIME certificates occurred.
4. 2024-02-13 Mis-issuance of the last S/MIME certificate occurred.
5. 2024-09-09 Scanning identified mis-issued S/MIME certificates with OrganizationIdentifier/Country discrepancies and the incident was created in the bug.
6. 2024-09-10 Three mis-issued certificates were revoked.
7. 2024-09-13 The last mis-issued certificate was revoked.
8. 2024-10-16 An interface change adding ISO Country Codes next to country names was deployed on production.

1. 2024-09-09 Assecods representative — Reported a preliminary incident: several S/MIME certificates had Organization Identifier and Country field discrepancies, covering 4 certificates, and stated mis-issued certificates would be revoked within 5 days.
2. 2024-09-20 Assecods representative — Published the incident report, describing discovery via scanning, root causes (validator limitations and confusion over similar country names), and remediation steps including linting and improved OrganizationIdentifier generation.
3. 2024-09-27 Assecods representative — Provided an action-items update with due dates for implementing S/MIME linting, improving OrganizationIdentifier generation, updating training, and adding ISO Country Codes in the UI.
4. 2024-10-05 Assecods representative — Requested that the next update be moved to October 31 to avoid weekly updates.
5. 2024-10-18 Assecods representative — Updated that adding ISO Country Code next to the country name was deployed on production on 2024-10-16 and that all action items were complete.
6. 2024-10-24 Assecods representative — Confirmed all action items were completed and that monitoring would continue.
7. 2024-10-31 Asseco Data Systems S.A. — Asked whether the bug could be closed if the community had no questions.
8. 2024-10-31 Mozilla representative — Stated an intention to close the bug on Wed 6-Nov-2024 if no additional questions or issues were raised before then.