SwissSign incident report for invalid StateOrProvinceName in Liechtenstein TLS OV certificates; all remediation completed and bug closed
SwissSign reported a certificate issuance incident affecting TLS OV certificates for Liechtenstein subscribers that contained the placeholder StateOrProvinceName value "Empty (No state for Liechtenstein)" when no state/province should have been present. The issue was first reported by a third party, after which SwissSign investigated, confirmed the misissuance, suspended issuance for the affected customer MPKI, and corrected the issuance logic. SwissSign identified 18 affected certificates across 4 subscribers, and said all affected certificates were revoked or expired naturally. The thread also established that the Certificate Problem Report was received on 2026-07-22 18:05 UTC and that revocation completed on 2026-07-28 06:35 UTC; SwissSign acknowledged that this exceeded the five-day deadline by about 12 hours and 30 minutes and said it would handle that delayed-revocation aspect in a separate Bugzilla report. On 2026-09-23, SwissSign posted a closure summary stating that all remediation action items were complete and requested closure of the incident report, and CCADB issued a final call for comments before the bug was closed.
- A placeholder subdivision value was created for Liechtenstein.
- A software change altered the source mapping used for StateOrProvinceName, causing non-compliant issuance to begin.
- A third party reported the invalid StateOrProvinceName values in Liechtenstein certificates.
- SwissSign confirmed the issue, suspended issuance for the affected customer MPKI, and corrected the issuance logic.
- Issuance resumed after validation of the fix.
- All affected certificates were revoked or expired naturally.
- SwissSign reported that all remediation action items were complete and requested closure of the incident report.
- SwissSign AG — SwissSign filed a preliminary incident report describing the third-party report, the affected Liechtenstein certificates, and that misissuance handling had begun.
- SwissSign AG — SwissSign posted a formal incident report with the affected-certificate count, revocation status, timeline, root cause, and related policy references.
- Community commenter — A commenter asked SwissSign to clarify the revocation clock and suggested the case might instead be delayed revocation.
- SwissSign AG — SwissSign said it had started the revocation timer at confirmation time, would update the report, and would open a separate delayed-revocation bug.
- Google representative — Chrome Root Program disagreed with SwissSign's revocation interpretation and cited BR 4.9.5 and the five-day deadline from CPR receipt.
- SwissSign AG — SwissSign acknowledged error in its earlier interpretation, confirmed the CPR receipt time and revocation completion time, and said revocation exceeded five days by approximately 12 hours and 30 minutes.
- SwissSign AG — SwissSign reported completion of several action items, said one placeholder-value review remained ongoing, and requested NextUpdate be set to 2026-09-23.
- SwissSign AG — SwissSign posted a closure summary stating that all action items were complete and requested closure of the incident report.
- CCADB representative — CCADB issued a final call for comments or questions and said the bug would be closed around 2026-09-30.