Sectigo QWAC misissuance involving jurisdictionCountry and organizationIdentifier mismatch
Sectigo reported a misissued QWAC certificate after receiving a Certificate Problem Report on 2026-08-07. The certificate had a mismatch between the organization’s French jurisdictionCountry information and a German country code in the Organization Identifier subject attribute. Sectigo said it concurred that the certificate was misissued and revoked it on 2026-08-12. In its full incident report, Sectigo said it reviewed issued QWAC certificates since 2025-01-01 and found no additional related misissuances. Sectigo also said it developed and deployed an additional pre-issuance linter to block recurrence of this specific error. On 2026-09-17, Sectigo said all action items were complete and requested closure of the bug. On 2026-09-23, CCADB posted a final call for comments and said the report would be closed around 2026-09-30.
- Sectigo issued the QWAC certificate with the country-code mismatch.
- A Certificate Problem Report identified the mismatch in the certificate.
- Sectigo revoked the certificate.
- Sectigo — Sectigo posted a preliminary incident report saying the certificate was misissued, revocation would be completed within the allocated timespan, and a full incident report would follow.
- Sectigo — Sectigo uploaded an affected-certificates CSV and posted the full incident report confirming revocation and stating no similar additional misissuances were found.
- Sectigo — Sectigo requested a next-update date of 2026-09-18 based on a pending action item.
- Sectigo — Sectigo said all action items were complete, described the deployed pre-issuance linter, and requested closure of the bug.
- CCADB representative — CCADB issued a final call for comments and said the incident report would be closed around 2026-09-30.