TWCA third-party report about subject.countryName using ISO 3166-1 alpha-2 territory codes
TWCA opened this bug after an external reporter alleged that certificates using dependent-territory country codes such as HK, MO, and KY were misissued because those territories are not UN member states. TWCA stated that the certificates comply with TLS Baseline Requirements Section 7.1.2.7, which requires ISO 3166-1 alpha-2 codes, and that the codes used are officially listed in ISO's database. TWCA said it does not consider the certificates misissued and that no revocation is planned. A SECOM reviewer and CCADB incident review both said the report does not establish a compliance incident requiring revocation and supported closing the bug as INVALID. The thread also notes that the same root cause is being tracked in bugs 2069766 and 2070071, and that further clarification from the CA/Browser Forum would be useful.
- An external reporter alleged that certificates with dependent-territory country codes were misissued because the territories are not UN member states.
- TWCA filed a preliminary incident report stating the certificates comply with BR Section 7.1.2.7 and no revocation is planned.
- A SECOM reviewer said the report does not show misissuance requiring revocation and supported closing the bug as INVALID.
- CCADB incident review said the report does not establish a compliance incident requiring revocation and proposed closing it as INVALID.
- Taiwan-CA Inc. (TWCA) — TWCA said an external reporter alleged misissuance, but TWCA concluded the certificates comply with BR Section 7.1.2.7 and filed the report for transparency.
- Taiwan-CA Inc. (TWCA) — TWCA said it aligns with the perspective in bug 2069766 and requested that this bug be closed as INVALID.
- Ml representative — SECOM said the use of an ISO 3166-1 alpha-2 code in subject:countryName does not by itself constitute misissuance and supported closing the bug as INVALID.
- CCADB representative — CCADB incident review said the report does not establish a compliance incident requiring revocation and proposed closing the bug as INVALID on or about 2026-09-23.