← SwissSign AG cases
Bugzilla #2033000
Certificate Problem Report
SwissSign: Certificate Profile error for S/MIME MV
ASSIGNED
SwissSign AG
AI Summary
SwissSign AG reported a compliance issue with their S/MIME certificate profile, specifically regarding the commonName field, which was incorrectly defined in their Certificate Policy/Certificate Practice Statement (CP/CPS). The auditors identified that the commonName should reflect a 'Mailbox Address' as per S/MIME BR requirements, but the CPR stated it as 'GivenName Surname or pseudo: Pseudonym (mandatory)'. SwissSign has since revoked all affected S/MIME MV certificates and updated their CPR to correct the error. The incident was disclosed following an audit, and all affected certificates were revoked within the required timeframe.
Chronology
- CPR S/MIME v13 published
- Non-compliance identified by auditors
- All affected certificates revoked
Participants
Sandy Balzer
Michael Guenther
Stephan Verbuecheln
Roman Fischer
External References
Similar Local Cases
SwissSign: Invalid CT data in issued certs (SABRE.CT misconfiguration)
SwissSign: CRL/OCSP revocation time mismatch
SwissSign: OCSP outage
SwissSign: 'c/o' in streetAddress of EV certificate
SwissSign: Certificate issue with Signature
SwissSign: Error in OrganisationIdentifier in signature/seal certificate
SwissSign: CP/CPS certificate profile issue
SwissSign: Failure to provide a preliminary report within 24 hours.