GlobalSign self-reported incident: Unicode replacement character in TLS certificate subject, remediation completed
GlobalSign reported a single TLS end-entity certificate incident involving a Unicode replacement character (U+FFFD) in the Subject distinguished name stateOrProvinceName field. The case was triggered by a third-party Certificate Problem Report, after which GlobalSign investigated and filed a preliminary report, then a full incident report. GlobalSign said the certificate was issued with malformed subject encoding due to incorrect TeletexString-to-UTF-8 handling during issuance, and that the affected certificate has since been revoked. The report states that issuance was not stopped, but requests were monitored for recurrence and the ftfy module was enabled as a backup measure. In the latest update, GlobalSign said it enabled ftfy in pkimetal on 2026-08-24, completed review of active modules on 2026-08-27, and that this concludes the identified remedial activities; it said it will post a closure report by 2026-09-03.
- A TLS end-entity certificate was issued with malformed Subject encoding.
- A Certificate Problem Report identified a Unicode replacement character issue in the certificate subject.
- The affected certificate was revoked.
- ftfy was enabled in pkimetal on the Atlas platform.
- GlobalSign completed review of active modules in pkimetal for both platforms.
- GlobalSign nv-sa — GlobalSign said it had received a CPR, was investigating, and would provide a full incident report by 2026-07-30.
- GlobalSign nv-sa — GlobalSign posted the full incident report describing the malformed subject encoding, the revocation of the affected certificate, and the code fix and ftfy enablement.
- GlobalSign nv-sa — GlobalSign said it was on track to enable ftfy in pkimetal by 2026-08-27 and requested the next update be set for 2026-08-28.
- GlobalSign nv-sa — GlobalSign repeated that it is on track to enable ftfy in pkimetal by 2026-08-27 and requested the next update be set for 2026-08-28.
- GlobalSign nv-sa — GlobalSign said ftfy had been enabled in pkimetal on 2026-08-24 and that it was on track with the remaining action.
- GlobalSign nv-sa — GlobalSign said the review of active modules in pkimetal for both platforms was completed on 2026-08-27 and that it would post a closure report by 2026-09-03.