Sectigo QWAC misissuance involving jurisdictionCountry and organizationIdentifier mismatch
Sectigo reported a misissued QWAC certificate after receiving a Certificate Problem Report on 2026-08-07. The issue was a mismatch between the organization’s French jurisdictionCountry information and the ISO 3166 country code used in the Organization Identifier subject attribute, where the Registration Scheme listed a German two-digit country code. Sectigo said it concurred that the certificate was misissued and intended to complete revocation within the allocated timespan. It also said it was investigating its certificate corpus for additional instances of the same error and would publish a Full Incident Report within the prescribed timelines. The bug remains assigned, and the thread provided no closure or final resolution beyond that initial incident report.
- A QWAC certificate was identified as having a jurisdictionCountry and organizationIdentifier country-code mismatch.
- Sectigo opened a preliminary incident report and stated it would revoke the misissued certificate within the allocated timespan.
- Sectigo — Martijn Katerbarg reported the incident, agreed the certificate was misissued, said revocation would be completed within the allocated timespan, and noted that a full incident report would follow.