GlobalSign: StateOrProvince and LocalityName value inconsistency with remediation updates
This case is a third-party Certificate Problem Report about TLS certificates with StateOrProvince and LocalityName values placed in the wrong fields. GlobalSign said the underlying values were validated under CA/Browser Forum TLS Baseline Requirements section 3.2.2.1, but Philadelphia was entered as stateOrProvinceName and Pennsylvania as localityName. GlobalSign’s investigation found 34 valid certificates across 14 subscribers with similar address-field inconsistencies, and it revoked the reported certificate plus the additional affected certificates within the applicable timelines. Since the last update, GlobalSign said it completed the deployment of pre-issuance linting for valid address field combinations and completed the quarterly self-audit linting update. The remaining action item in the thread is to implement input-validation controls for predefined address-field combinations, and GlobalSign asked for the next update to be set for 2026-10-28. The bug remains assigned to GlobalSign.
- Earliest affected certificate issued with inconsistent StateOrProvince and LocalityName values
- Reported TLS certificate issued
- Certificate Problem Report received for the affected certificate
- Reported certificate revoked
- Revocation of additional certificates identified in the review began and ended
- Pre-issuance linting for valid address field combinations was completed
- Quarterly self-audit address-field linting was completed
- GlobalSign nv-sa — GlobalSign opened a preliminary incident report saying it had received a Certificate Problem Report and would provide a full incident report by 2026-08-28.
- GlobalSign nv-sa — GlobalSign said it was finalizing its investigation and expected to publish the full incident report by 2026-09-02.
- GlobalSign nv-sa — GlobalSign posted the full incident report, described the field-value inconsistency, listed 34 affected valid certificates, and said revocation and preventive measures had been carried out.
- GlobalSign nv-sa — GlobalSign said pre-issuance linting and quarterly self-audit updates were delayed and provided revised due dates, while noting that the address-field list and post-issuance linting were completed.
- GlobalSign nv-sa — GlobalSign said it was on track with the remaining actions and requested the next update be set for 2026-10-01.
- GlobalSign nv-sa — GlobalSign said it completed pre-issuance linting for valid address field combinations and was on track with the remaining actions.
- GlobalSign nv-sa — GlobalSign said the quarterly self-audit address-field linting action was completed and requested the next update be set for 2026-10-28.