SSL.com third-party incident report for invalid subject stateOrProvince values; all action items completed
This case remains a third-party Certificate Problem Report about invalid subject stateOrProvinceName values in SSL.com certificates. SSL.com said a business-registry lookup tool used during organization validation could auto-fill subject fields in the background and, in some cases, insert malformed geographic information or contribute to an organization-name mismatch. SSL.com reported that the feature was turned off during investigation and that all 20 affected certificates are now revoked. The company also stated that there was no revocation delay. In the latest update, SSL.com said Action Item #5, its internal response rework for potential misissuance events, was completed on 2026-10-29, and that all action items for the incident are now complete. SSL.com said it plans to provide a Report Closure Summary on or before 2026-11-06 if there are no further comments or questions.
- A business-registry lookup tool began auto-filling subject fields during organization validation.
- A third-party Certificate Problem Report was received about invalid stateOrProvinceName values in OV TLS certificates.
- The business-registry lookup feature was turned off.
- SSL.com reported 20 affected certificates and said 15 were revoked at that time.
- SSL.com updated the incident report and said all 20 affected certificates were identified.
- SSL.com said Action Item #3 had begun deployment in staging and Action Item #4 had been deployed to production.
- SSL.com said Action Item #3 was complete and Action Item #5 remained in progress.
- SSL.com said leadership approved its updated internal response to potential misissuance events, completing Action Item #5.
- SSL.com — SSL.com posted a preliminary incident report saying it had received a third-party CPR and was investigating the root cause and scope.
- SSL.com — SSL.com said it was concluding its investigation and preparing the full incident report within the 14-day timeframe.
- SSL.com — SSL.com posted the full incident report describing the business-registry lookup tool, the affected certificate counts, and the revocation status at that time.
- SSL.com — SSL.com reposted the report with updates, said it found 20 total affected certificates, and said it would continue monitoring the bug and provide another update by 2026-08-21.
- SSL.com — SSL.com said it continues to monitor the bug, work on the action items, and will provide an update on or before 2026-08-28.
- SSL.com — SSL.com said development and code review for Action Items #3 and #4 were complete, both changes were merged, production deployment was scheduled, and Action Item #5 remained in progress.
- SSL.com — SSL.com said Action Item #3 had begun deployment in staging, Action Item #4 was deployed to production, Action Item #5 remained in progress, and the business-registry lookup would stay disabled until completion.
- SSL.com — SSL.com said Action Item #3 was deployed and complete, while Action Item #5 remained in progress.
- SSL.com — SSL.com said Action Item #5 was complete, all action items were finished, and it planned to provide a closure summary by 2026-11-06.