← DigiCert cases
Bugzilla #1936906
Certificate Misissuance
DigiCert: Invalid Characters in S/MIME Subject Fields
RESOLVED
FIXED
DigiCert
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
DigiCert reported a compliance issue involving the issuance of 21 S/MIME certificates containing invalid characters (accents) in the SubjectDN and SAN fields. This problem arose due to a misconfiguration in the linting process on their legacy QuoVadis system, which allowed these certificates to be issued despite the errors being logged. DigiCert halted S/MIME issuance from the affected legacy operations and revoked all impacted certificates within the required timeframe. They have since corrected the linting configuration and are committed to maintaining compliance until the legacy system is fully deprecated by March 31, 2025.
Chronology
- Issue reported via post-issuance linting, additional research kicked off.
- All affected certificates revoked.
- Incident Report Closure Summary provided.
Thread Activity
- DigiCert — There was a bug in the script that integrates pkilint into our legacy European operations, resulting in some certificates with invalid characters being issued.
- Sectigo — Questioned why the issuing platform allowed the issuance of these certificates.
- DigiCert — Provided a closure summary detailing the incident and remediation steps.
Participants
DigiCert
Sectigo
Mozilla representative
External References
Similar Local Cases
DigiCert: Typo in TLS Org Name
DigiCert: Random value in CNAME without underscore prefix
DigiCert: Encoded HTML entities in attribute values
DigiCert: Org information issue in new validation workflow
DigiCert: Incorrect case in Business Category
DigiCert: Incorrect Org ID Scheme in S/MIME
DigiCert: Misissued code signing certificates
DigiCert: Internal Domain Name cert mis-issuance