DigiCert EV QWAC organizationIdentifier subdivision code mismatch

This case concerns a third-party reported misissuance in DigiCert EV QWAC certificates. DigiCert said an EV QWAC certificate’s NTR organizationIdentifier omitted the ISO 3166-2 subdivision code required for the jurisdiction of incorporation, contrary to EV Guidelines section 7.1.4.2.8. DigiCert identified 64 affected active certificates, paused new validations of this type, notified affected subscribers, and revoked all 64 certificates by 2026-09-25. DigiCert also said it implemented a pre-issuance lint to block this mismatch and a feature-parity review process for controls across certificate types. The bug was later marked with a closure summary and a final call for comments from CCADB.

1. 2025-09-24 Earliest affected EV QWAC certificates were issued with non-compliant organizationIdentifier values.
2. 2026-09-19 DigiCert received a Certificate Problem Report about the EV QWAC organizationIdentifier mismatch.
3. 2026-09-25 All 64 affected certificates were revoked.
4. 2026-10-12 DigiCert posted a closure summary and requested bug closure.

1. 2026-09-22 DigiCert — DigiCert filed a preliminary incident report saying a third party reported an EV QWAC organizationIdentifier mismatch.
2. 2026-10-02 DigiCert — DigiCert attached a revoked certificates dossier and posted the full incident report.
3. 2026-10-05 Community commenter — Adrian Mueller asked for clarification on the registration basis for the affected jurisdictions and argued the CPR may be invalid for some of them.
4. 2026-10-07 DigiCert — DigiCert thanked Adrian for the feedback and said the CABF Validation Subcommittee intended to revisit the topic.
5. 2026-10-12 DigiCert — DigiCert posted a report closure summary stating all action items were completed and requested closure.
6. 2026-10-12 CCADB representative — CCADB issued a final call for comments and said the bug would be closed around 2026-10-19.