DigiCert CPR about subject.countryName and ISO 3166-1 alpha-2 codes
This case concerns a third-party Certificate Problem Report sent to DigiCert about the use of certain countryName values in certificates. The reporter argued that some CA-issued country codes did not meet the Baseline Requirements definition of “Country” and asked for revocation and a Bugzilla case. DigiCert responded that the issue was a standards-interpretation question, not a compliance incident, and said no certificates had been misissued. GoDaddy and Hongkong Post said they reviewed the same report and agreed with DigiCert’s interpretation. CCADB incident-reporting later said closure as INVALID appeared appropriate on the limited basis that use of an appropriately assigned ISO 3166-1 alpha-2 code in subject countryName does not by itself constitute misissuance. The bug was resolved INVALID.
- DigiCert received a third-party Certificate Problem Report about subject.countryName values and ISO 3166-1 alpha-2 country codes.
- CCADB incident-reporting said closure as INVALID appeared appropriate on the limited basis described in its comment.
- The bug was slated to be closed as INVALID if there were no contrary comments.
- DigiCert — DigiCert opened the bug with a preliminary incident report, said it did not consider the issue a compliance incident, and requested closure as INVALID.
- DigiCert — DigiCert added a link to the ISO 3166 country codes page.
- GoDaddy — GoDaddy said it received the same CPR and agreed with DigiCert’s interpretation and conclusion.
- Certizen representative — Hongkong Post said it also received the same CPR and agreed that use of C=HK did not constitute misissuance.
- DigiCert — DigiCert reiterated that the issue was best addressed through CA/Browser Forum discussion and again requested INVALID.
- CCADB representative — CCADB said closure as INVALID appeared appropriate on the limited basis stated and noted that the forum might need to clarify the requirements.