DigiCert EV/QWAC jurisdictionCountry misissuance; incident report closed after all remediation completed
This case concerns an EV subscriber certificate, also described as an eIDAS QWAC, whose jurisdiction fields did not match the registration information encoded in `organizationIdentifier`. DigiCert said a community member reported the issue, and DigiCert then received a Certificate Problem Report on 2026-08-07 and confirmed the misissuance the same day. DigiCert reported that three certificates were affected in total, all were revoked by 2026-08-12, and no affected certificates remain valid. The company corrected the validation logic on 2026-08-07, added a pre-issuance control to block the same error, and completed a linting / periodic CT-scan rule as Action Item #3 on 2026-09-01. On 2026-09-08, DigiCert filed a closure summary stating that all three action items were complete and requesting closure, and CCADB issued a final call for comments saying the incident report would be closed around 2026-09-15.
- The earliest affected EV certificate was issued with incorrect jurisdiction attributes.
- A second affected certificate was issued.
- A third affected certificate was issued.
- DigiCert received a CPR and confirmed the misissuance.
- DigiCert corrected and deployed the validation logic.
- Revocation of the affected certificates was completed.
- DigiCert completed Action Item #3 to add a linting / periodic CT-scan rule.
- DigiCert — DigiCert filed a preliminary incident report saying a community member reported the EV certificate jurisdictionCountry inconsistency.
- DigiCert — DigiCert said it would post the full incident report on or before 2026-08-21.
- DigiCert — DigiCert posted the full incident report describing the CPR, the affected certificates, the fix, and revocation completion.
- DigiCert — DigiCert attached Bugzilla_JOI_dossier.csv.
- DigiCert — DigiCert said it was continuing to work on the final action item and would provide an update on or before 2026-08-31.
- DigiCert — DigiCert said it had completed Action Item #3 to add a linting / periodic CT-scan rule.
- DigiCert — DigiCert filed a report closure summary stating that all three action items were complete and requesting closure.
- CCADB representative — CCADB issued a final call for comments or questions and said the incident report would be closed around 2026-09-15.