GlobalSign third-party reported incident: Unicode replacement character in certificate subject; closure completed
This case concerns a third-party Certificate Problem Report about one TLS end-entity certificate issued by GlobalSign with a Unicode replacement character (U+FFFD) in the Subject distinguished name stateOrProvinceName field. GlobalSign said the certificate was issued with malformed subject encoding due to incorrect TeletexString-to-UTF-8 handling during issuance, and that the affected certificate was revoked. GlobalSign reported that issuance was not stopped, but requests were monitored for recurrence, and it later enabled the ftfy module in pkimetal and reviewed active modules on both platforms. In its closure summary, GlobalSign said it rewrote the transcoding logic to handle TeletexString input correctly and that all disclosed action items had been completed. CCADB then issued a final call for comments or questions and said the incident report would be closed around 2026-09-14; the bug is now resolved.
- A TLS end-entity certificate was issued with malformed Subject encoding.
- A Certificate Problem Report identified a Unicode replacement character issue in the certificate subject.
- The affected certificate was revoked.
- ftfy was enabled in pkimetal on the Atlas platform.
- GlobalSign completed review of active modules in pkimetal for both platforms.
- GlobalSign nv-sa — GlobalSign said it had received a CPR, was investigating, and would provide a full incident report by 2026-07-30.
- GlobalSign nv-sa — GlobalSign posted the full incident report describing the malformed subject encoding, the revocation of the affected certificate, and the code fix and ftfy enablement.
- GlobalSign nv-sa — GlobalSign said it was on track to enable ftfy in pkimetal by 2026-08-27 and requested the next update be set for 2026-08-28.
- GlobalSign nv-sa — GlobalSign repeated that it is on track to enable ftfy in pkimetal by 2026-08-27 and requested the next update be set for 2026-08-28.
- GlobalSign nv-sa — GlobalSign said ftfy had been enabled in pkimetal on 2026-08-24 and that it was on track with the remaining action.
- GlobalSign nv-sa — GlobalSign said the review of active modules in pkimetal for both platforms was completed on 2026-08-27 and that it would post a closure report by 2026-09-03.
- GlobalSign nv-sa — GlobalSign posted a closure summary stating that all action items were completed and requesting closure.
- CCADB representative — CCADB issued a final call for comments or questions and said the incident report would be closed around 2026-09-14.