← Sectigo cases
Bugzilla #2062202 Ca Certificate Compliance Incident Self Reported Incident Certificate Misissuance Validation Issue

Sectigo QWAC misissuance involving jurisdictionCountry and organizationIdentifier mismatch

ASSIGNED Sectigo
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update. Always refer to the official Bugzilla thread as the authoritative source. If you spot an inaccuracy, let me know via the contact form.
AI Summary

Sectigo reported a misissued QWAC certificate after receiving a Certificate Problem Report on 2026-08-07. The certificate had a mismatch between the organization’s French jurisdictionCountry information and a German country code in the Organization Identifier subject attribute. Sectigo said it concurred that the certificate was misissued and revoked it on 2026-08-12. In its full incident report, Sectigo said it reviewed issued QWAC certificates since 2025-01-01 and found no additional related misissuances. Sectigo also said it developed and deployed an additional pre-issuance linter to block recurrence of this specific error. On 2026-09-17, Sectigo said all action items were complete and requested closure of the bug. On 2026-09-23, CCADB posted a final call for comments and said the report would be closed around 2026-09-30.

Model: gpt-5.4-mini Generated: 2026-08-16 08:20 UTC Revised: 2026-09-27 07:01 UTC Confidence: 0.99 6 comments
Chronology
  1. Sectigo issued the QWAC certificate with the country-code mismatch.
  2. A Certificate Problem Report identified the mismatch in the certificate.
  3. Sectigo revoked the certificate.
Thread Activity
  1. Sectigo — Sectigo posted a preliminary incident report saying the certificate was misissued, revocation would be completed within the allocated timespan, and a full incident report would follow.
  2. Sectigo — Sectigo uploaded an affected-certificates CSV and posted the full incident report confirming revocation and stating no similar additional misissuances were found.
  3. Sectigo — Sectigo requested a next-update date of 2026-09-18 based on a pending action item.
  4. Sectigo — Sectigo said all action items were complete, described the deployed pre-issuance linter, and requested closure of the bug.
  5. CCADB representative — CCADB issued a final call for comments and said the incident report would be closed around 2026-09-30.
Participants
Sectigo CCADB representative
External References
Related Bugzilla IDs Mentioned
Similar Local Cases
#2056087 RESOLVED Ca Certificate Compliance Incident Externally Reported Incident Certificate Misissuance Opened 2026-07-19 · Closed 2026-09-14 · 89% similar
Disig: CP/CPS misstatement regarding Key Usage criticality for TLS certificates
#1977253 RESOLVED Certificate Misissuance Opened 2025-07-14 · Closed 2025-09-15 · 87% similar
Sectigo: OV reuse data applied for wrong organization
#2062100 RESOLVED Ca Certificate Compliance Incident Self Reported Incident Certificate Misissuance Opened 2026-08-10 · Closed 2026-09-17 · 85% similar
DigiCert: jurisdictionCountry in EV certificate
#2061178 ASSIGNED Ca Certificate Compliance Incident Self Reported Incident Certificate Misissuance Opened 2026-08-06 Still Open · 83% similar
Asseco DS / Certum: Incorrect Country in certificate
#1902748 RESOLVED Certificate Misissuance Revocation Issue Opened 2024-06-14 · Closed 2026-06-10 · 82% similar
Sectigo: QWAC certificates issued with incorrect subject:organizationIdentifier attribute value
#2069636 ASSIGNED Ca Certificate Compliance Externally Reported Incident Certificate Misissuance Policy Document Issue Opened 2026-09-05 Still Open · 81% similar
Sectigo: CP/CPS language involving extendedKeyUsage found to be subject to multiple interpretations
#2054098 RESOLVED Self Reported Incident Certificate Misissuance Revocation Issue Remediation Tracking Opened 2026-07-10 · Closed 2026-09-02 · 81% similar
Sectigo: Incorrect jurisdictionStateOrProvinceName attribute value in Code Signing certificate
#1891245 RESOLVED Certificate Misissuance Opened 2024-04-12 · Closed 2024-05-13 · 81% similar
Sectigo: EV Certificate issuance with incorrect subject:serialNumber attribute value

We use only essential cookies and local browser storage for preferences and security. See our Privacy Policy for details.

⚠

Confirm action