SwissSign S/MIME CPR profile description error; incident report closed after remediation
SwissSign disclosed an incident after auditors found that chapter 3.3.1.7 of its S/MIME CPR v13 described the commonName field incorrectly for S/MIME MV certificates. SwissSign said the CPR text did not match the S/MIME BR requirement that the CN be a mailbox address, while the issued end-entity certificates themselves were compliant. SwissSign updated the CPR, identified the affected certificates, and revoked all affected certificates on 2026-04-22. The company then tracked remediation work on review guidelines, template coverage, and test-plan checks, and later reported that all action items were completed. On 2026-07-02, SwissSign posted a Report Closure Summary and requested closure, and CCADB issued a final call for comments with a planned close date of about 2026-07-09; the bug is now RESOLVED/FIXED.
- SwissSign published CPR S/MIME v13 with the incorrect commonName profile description for S/MIME MV certificates.
- Auditors identified the CPR profile description error and SwissSign began analysis and remediation.
- SwissSign published an updated CPR v15 note clarifying that the certificate CN is copied from the Email field.
- SwissSign revoked all affected certificates.
- SwissSign posted the Report Closure Summary and requested closure.
- SwissSign AG — SwissSign reported that auditors found an error in the CPR S/MIME commonName description and said the issue was disclosed from auditor information.
- SwissSign AG — SwissSign provided the full incident report, including the affected certificate count, timeline, and revocation completion.
- Verbuecheln representative — Stephan noted a wording issue in the updated CPR text and pointed out that the typo also appeared in the PDF.
- SwissSign AG — SwissSign said it would correct the typo in the next CPR update.
- SwissSign AG — SwissSign corrected the date in the incident timeline for the publication of CPR S/MIME v13.
- SwissSign AG — SwissSign said action item #1 was done and the other action items were ongoing.
- SwissSign AG — SwissSign said action item #3 was completed and action item #2 was still ongoing.
- SwissSign AG — SwissSign said action item #2 was completed and that it was preparing the Report Closure Summary.
- SwissSign AG — SwissSign posted the Report Closure Summary, stated that all action items were completed, and requested closure.
- CCADB representative — CCADB issued a final call for comments or questions and said the incident report would be closed around 2026-07-09.