1710206 - Asseco DS / Certum: Incorrect localityName

Status: RESOLVED INVALID

(CA Program :: CA Certificate Compliance, task)

Description

[Michel Le Bihan]

Hello,
I noticed that the certificate https://crt.sh/?id=1638144545 that has the localityName: Biała and stateOrProvinceName: mazowieckie. It seems wrong because there is no such locality in this voivodeship. These is a locality with a similar name: Stara Biała (TERC 1419132) and two localities with the same name, but in different voivodeships: Biała (TERC 1017012) in Łódzkie and Biała (TERC 1610013) in Opolskie. That can be checked on https://eteryt.stat.gov.pl/

Comment 1

[Ryan Sleevi]

Michel: We're still waiting for an incident report from Asseco DS / Certum on Bug 1709392. However, for now I've held off duplicating, because what you've highlighted is an EV certificate, while Bug 1709392 relates to an OV certificate.

Aleksandra: Please file a separate incident report for this issue, so that we can independently determine whether to duplicate. As part of this incident report, please identify the data source(s) you used to validate this EV certificate, which you're required to track and disclose, per Ballot SC30.

Comment 2

[Michel Le Bihan]

Hmm. There is Biała (SIMC 0576036), so that looks OK.

Comment 3

[Michel Le Bihan]

Can localityName be just a city/town/village or should it be the smallest unit of administrative subdivision? Units of administrative division are in TERC and cities/towns/villages are in SIMC.

Comment 4

[Ryan Sleevi]

Yes, locality can contain cities/towns/villages. The X.500 model was a bit fluid here, because it imagined a centralized global naming source with delegation (e.g. leaving it up to countries / states or provinces to manage naming - see early RFCs like RFC 1255), and that of course (thankfully) never came to pass.

With respect to the BRs, locality is left to the CA to demonstrate the relevant data source and verification and their determination. However, the notion of localityName being a subdivision like a city, county, or geographic region is within reason, see e.g. RFC 2256. The complexity here, as it always is with regional information, is geopolitical. While country and stateOrProvince have been seen as (explicitly) ISO 3166-1 and (implicitly) ISO 3166-2 , respectively, localityName is a bit more fluid.

Note that, in general, the recommended way to report concerns is directly to the CA, since they MUST provide a preliminary incident report within 24 hours, which does not necessary trigger by filing a Bugzilla bug. Of course, if you're not satisfied with the answer, or still have concerns, opening a Bug or posting on m.d.s.p. is totally appropriate.