Sectigo: Misissued EV Code Signing certificate with incorrect jurisdictionStateOrProvinceName value

Sectigo opened this bug after a third-party support request reported an incorrect jurisdictionStateOrProvinceName value in an EV Code Signing certificate. Sectigo’s incident report says the validation team changed the jurisdiction and serialNumber subject attributes during processing, then failed to restore them before issuance, which caused one misissued certificate. Sectigo revoked the certificate on 2026-07-10 after the support ticket was processed and the issue was escalated. The bug remained open in ASSIGNED status while Sectigo worked through its action items. On 2026-08-26, Sectigo said its final action item had been completed and requested closure, and CCADB posted a final call for comments saying the report would be closed around 2026-09-02 if there were no further questions.

1. 2026-07-01 Sectigo began processing the affected certificate request and changed subject attribute values during validation.
2. 2026-07-06 The EV Code Signing certificate was issued.
3. 2026-07-10 The certificate was revoked after the support ticket was processed and the incident was escalated.
4. 2026-08-26 Sectigo said all action items were complete and requested closure of the incident report.

1. 2026-07-10 Sectigo — Sectigo filed a preliminary incident report saying it had received a support request about an incorrect jurisdictionStateOrProvinceName value and was investigating the root cause.
2. 2026-07-23 Sectigo — Sectigo attached an affected-certificates CSV and posted a full incident report describing the misissuance, timeline, impact, and revocation.
3. 2026-07-29 Sectigo — Sectigo said it was monitoring the bug for questions and comments while continuing its action items.
4. 2026-08-04 Sectigo — Sectigo said 3 of 4 action items were complete and requested a next update for 2026-08-31.
5. 2026-08-26 Sectigo — Sectigo said its final action item had been completed and requested closure.
6. 2026-08-26 CCADB representative — CCADB issued a final call for comments and said the report would be closed around 2026-09-02 if there were no further questions.