Certum EV TLS certificates issued with branch name in subject organizationName
Certum reported a third-party-identified incident involving two EV TLS certificates issued for organizations registered in Hong Kong. In each case, the certificate’s subject organizationName contained a branch name, while the subject serialNumber referred to the parent corporation’s registration number. Certum said the validation records did not establish that the branches were legally recognized entities distinct from their parent corporations, and the parent corporation’s full legal name was not included in subject organizationName. Certum investigated the validation process, reviewed other Hong Kong EV TLS and EV Code Signing requests, and stopped one similar pending request before issuance. Both affected certificates were revoked, and Certum updated its Hong Kong validation instructions and training before requesting closure.
- Certum issued the first affected EV TLS certificate after validating the request.
- Certum issued the second affected EV TLS certificate after validating the request.
- Certum received a Certificate Problem Report about one affected certificate and began investigating.
- Certum revoked the first affected certificate.
- Certum revoked the second affected certificate.
- Certum incorporated clarification from the Hong Kong business registration authority into revised validation instructions.
- Assecods representative — Certum filed a preliminary incident report saying a third party reported the issue and that scope review was ongoing.
- Assecods representative — Certum filed the full incident report, described the two affected certificates, and said one similar pending request had been stopped before issuance.
- Assecods representative — Certum updated the action items and marked the remediation tasks complete.
- Assecods representative — Certum posted the closure summary and requested closure of the incident report.
- CCADB representative — CCADB issued a final call for comments and said the bug would be closed if no further questions were raised.