1675923 - DigiCert: TERENA: Insufficient validation of organizationalUnitName

Status: RESOLVED INVALID

(CA Program :: CA Certificate Compliance, task)

Description

[Michel Le Bihan]

Hello,
I discovered 2 certificates: https://crt.sh/?id=312556089 and https://crt.sh/?id=378080691 both expired and first one revoked a day after issuance that have Informatyzacja Uczelni,CN=portal-zsi.pwr.edu.pl and Informatyzacja Uczelni,CN=test-qss.pwr.edu.pl in organizationalUnitName respectively. I'm not sure if it's a case of miss issuance, but I thought that it's better to report it just in case it is.

Comment 1

[Ben Wilson]

As you note, both of these expired in early 2019. Much has happened since then. How do we know that they weren't already reported previously. I'm not sure that there is anything actionable about them at this point.

Comment 2

[George [:fozzie]]

Even if this is a violation (I'm not sure it is), DigiCert has implemented constraints for this field in bug 1639032.

Comment 3

[Jeremy Rowley]

I don't have anything to add to this bug that hasn't already been mentioned in other bugs or the comments above. They've been expired for almost two years, we've turned off OU in general with a couple of exception accounts, and we've implemented a lot of checking and redid the entire validation system in the bug george mentioned and https://bugzilla.mozilla.org/show_bug.cgi?id=1639032.