← certSIGN cases
Bugzilla #2082361
Ca Certificate Compliance
Incident
Self Reported Incident
Certificate Misissuance
Validation Issue
certSIGN incident report: DV test certificate profile missing countryName in Subject DN
ASSIGNED
certSIGN
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
certSIGN reported a compliance incident involving a test DV TLS certificate that was issued without the countryName attribute in the Subject DN, contrary to certSIGN’s DV CPS. The issue was first identified after certSIGN received a Certificate Problem Report by email from Ryan Daurne on 2026-10-14. certSIGN said the affected DV profiles were disabled after the problem was confirmed, which stopped issuance and renewal for those profiles. The company later updated and published the CPS, then revoked the affected certificates and completed the incident. certSIGN stated that 55 certificates were affected in total and that all affected certificates had expired or been revoked by the end of the incident.
Chronology
- certSIGN published a new DV CPS version that required countryName in the Subject DN.
- The first DV certificate without countryName was issued.
- certSIGN received a Certificate Problem Report by email about the missing countryName attribute.
- certSIGN started an internal investigation and stopped issuance and renewals for the affected profiles.
- certSIGN revoked affected certificates and allowed issuance again after publishing the updated CPS.
- certSIGN completed revocation and renewal for the remaining impacted client certificate and ended the incident.
Thread Activity
- certSIGN — Posted a preliminary incident report describing the missing countryName attribute and the CPR source.
- certSIGN — Posted the full incident report with impact, timeline, root cause analysis, and action items.
Participants
certSIGN
External References
Similar Local Cases
certSIGN: OCSP responder certificate encoded subject attributes out of order
certSIGN: Missing localityName in an OV certificate
certSIGN: Certificates with incorrect Subject attribute order
certSIGN: misissued an OV SSL certificate with no organizationName and localityName, instead of a DV SSL as requested by client
certSIGN: Subscriber precertificate without Certificate Policies
certSIGN: certificates with delayed SCT signature
certSIGN: delay in updating a Bugzilla ticket
Disig: CRL contains not allowed attributes