GlobalSign: Organization-validated S/MIME certificate issued with invalid Subject:organizationIdentifier (NTR scheme structure)

GlobalSign reported a compliance incident after being notified by its post-linter of an organization-validated S/MIME certificate with an invalid Subject:organizationIdentifier structure. The Baseline Requirements for S/MIME require that for the NTR Registration Scheme, where the Legal Entity is registered within a European country, the NTR Registration Scheme must be assigned at the country level; the affected certificate included subdivision +BY, resulting in an invalid structure. GlobalSign stated that one organization-validated SMIME certificate was issued with an invalid organizationIdentifier value and that it completed a review of historically issued certificates and pending requests, finding no additional affected certificates. GlobalSign scheduled revocation for the affected certificate and later revoked it. In its incident report, GlobalSign attributed the root cause to a combination of human error, missing technical restrictions in the vetting workflow for the country-level assignment, and incomplete lint coverage in the pre-linter configuration during a transition period. GlobalSign reported remedial actions including deploying a technical restriction in the vetting flow, delivering refresher training to vetting agents, deploying pkilint as a pre-linter in production, and adding further technical restrictions after a gap analysis; it requested closure of the incident report.

1. 2025-01-29 GlobalSign issued an organization-validated S/MIME certificate that later was found (via post-linter) to have an invalid Subject:organizationIdentifier structure for the NTR scheme.
2. 2025-02-03 GlobalSign deployed a technical restriction in the vetting flow for NTR and European countries and revoked the affected certificate.
3. 2025-02-18 GlobalSign deployed pkilint as a pre-linter in production and deployed additional technical restrictions in the vetting workflow.
4. 2025-02-21 GlobalSign delivered training, completed remedial activities, and requested closure of the incident report.

1. 2025-01-30 GlobalSign nv-sa — Opened a preliminary incident report stating GlobalSign was notified by its post-linter about an invalid Subject:organizationIdentifier structure and planned to provide the full incident report by Feb 5, 2025.
2. 2025-02-05 GlobalSign nv-sa — Provided the full incident report with impact, timeline, root cause, and completed/committed action items including revocation and vetting workflow changes.
3. 2025-02-12 GlobalSign nv-sa — Updated that training was on track and asked to set the “Next Update” to Feb 21, 2025.
4. 2025-02-21 GlobalSign nv-sa — Reported that training was delivered, pkilint was deployed as a pre-linter in production, gap analysis and additional technical restrictions were completed, and requested incident report closure.
5. 2025-02-21 Mozilla representative — Stated an intention to close the bug on or about Feb 26, 2025 unless there were issues or questions.