2056882 - D-Trust: EV Subordinate CA missing required cabfOrganizationIdentifier extension

Status: RESOLVED INVALID

(CA Program :: CA Certificate Compliance, task)

Description

[Ana Laura Martorano]

Preliminary Incident Report

Summary

• Incident description:
  We received a Certificate Problem Report regarding the subordinate CA certificate "D-TRUST EV CA 2-23-2 2023". The certificate contains subject:organizationIdentifier (VATDE-202620438) without the cabfOrganizationIdentifier extension (2.23.140.3.1), in violation of the EV Guidelines in effect at issuance (v1.8.0, Section 9.8.2). We confirm the finding.
  Our preliminary assessment: This subordinate CA has never issued any subscriber certificates. The only certificate ever issued from it is a delegated OCSP responder certificate for its own revocation status service. No subscriber or relying party is impacted.

• Relevant policies:
  EV Guidelines v1.8.0, Section 9.8.2, Effective 2022-11-30 (in effect at the time of issuance).
  Identical requirement in the current EV Guidelines v2.0.3, Section 7.1.2.2

• Source of incident disclosure:
  Third Party Reported

Comment 1

[Ana Laura Martorano]

Investigation Conclusion and Request for Closure

TL;DR

D-Trust confirms the reported certificate contents but, after completing its requirements analysis, does not confirm that the certificate was misissued.

The requirement in EV Guidelines v1.8.0, Section 9.8.2 did apply to EV Subscriber Certificates, not to the D-Trust-controlled subordinate CA certificate. The TLS Baseline Requirements profile permitted at issuance also did not prohibit the verified organizationIdentifier attribute or require a corresponding cabfOrganizationIdentifier extension.

The same conclusion was reached for Bug 2056663 which deals with the same topic.

D-Trust therefore requests closure of this bug as INVALID.

Certificate and reported condition

The report concerns the subordinate CA certificate:

• Certificate serial #: 52ED26B030918DF0B4874DE446D8F622
• Subject CN: D-TRUST EV CA 2-23-2 2023
• notBefore: 2023-05-11 11:42:12 UTC
• Subject attribute: organizationIdentifier (OID: 2.5.4.97)=VATDE-202620438
• Extension alleged to be missing: cabfOrganizationIdentifier (OID: 2.23.140.3.1)
• SHA-1 Fingerprint: A249979FB0E92BB253EC0B6BDFF474DB6CCDA66D
• SHA-256 fingerprint: 5FF9F5A1C0ED7401E1C529F6D50C4ABB00B17B593358BD2D61DC0DD887DDD92F

D-Trust confirms these certificate contents. The statement in the Preliminary Incident Report that “We confirm the finding” is corrected accordingly: D-Trust confirms the factual certificate contents, but not the conclusion that they constitute non-compliance.

Extended Validation Guidelines

The report relies on EV Guidelines v1.8.0, Section 9.8.2:

If the subject:organizationIdentifier is present, this field MUST be present.

Read in isolation, this sentence does not identify the relevant certificate type. Its scope must therefore be determined from the structure of the EV Guidelines.

Section 9 concerns the EV Certificate content and profile. Section 9.2 expressly extends its Subject requirements to subordinate CAs only where the subordinate CA is not controlled by the same entity as the issuing CA. The certificate at issue is controlled by D-Trust GmbH, the same entity as the issuing CA.

Section 9.8 also contains the required subjectAltName:dNSName profile for host Domain Names associated with the Subject's server. This is an EV Subscriber Certificate requirement and is not part of a subordinate CA certificate profile. Where the EV Guidelines impose requirements on subordinate CA certificates, such as in Sections 9.3.4 and 9.7, they identify subordinate CA certificates expressly.

The same scope question was addressed in Bug 2056663. Following discussion among CA/Browser Forum members, the Forum Chair provided a formal response stating:

The requirements for the presence and contents of extensions in EV CA certificates are indicated in section 7.1.4.3. The requirements for extensions in section 7.1.2 (where the OrgId extension is listed alongside the SAN extension) are applicable only to Subscriber Certificates.

D-Trust recognizes that this response was not a ballot and did not amend the normative requirements. It nevertheless directly confirms the scope supported by the structure and content of the EV Guidelines.

Section 9.8.2 therefore did not require the cabfOrganizationIdentifier extension in this subordinate CA certificate.

TLS Baseline Requirements

The TLS Baseline Requirements must also be considered because the reported certificate is a publicly trusted subordinate CA certificate.

For certificates issued before 15 September 2023, TLS Baseline Requirements v2.0.0, Section 7.1 expressly permitted issuance under either the v2.0.0 certificate profile or the profile in TLS Baseline Requirements v1.8.6.

With respect to the reported condition, the CA certificate complies with the permitted v1.8.6 profile:

• Section 7.1.4.3 required commonName, organizationName, and countryName; all are present.
• Section 7.1.4.3 required all Subject information to be accurate at issuance.
• Section 7.1.2.4 All Certificates permitted certificate data not otherwise specified where the CA was aware of a reason for including it and the data was not misleading.

VATDE-202620438 is D-Trust GmbH's verified German Value Added Tax (VAT) registration number. It was included to identify the legal entity operating the CA and is consistent with the Subject organization name.

TLS Baseline Requirements v1.8.6 did not prohibit subject:organizationIdentifier in a CA certificate and did not require a corresponding cabfOrganizationIdentifier extension.

Impact

No non-compliance or misissuance was identified. Consequently, no certificate replacement or revocation obligation arose.

The subordinate CA has not issued Subscriber Certificates. It issued one delegated OCSP responder certificate for its revocation status service. This limits the potential impact but is not the basis for the compliance conclusion.

Report Closure Summary

• Incident description: A third party alleged that th CA certificate D-TRUST EV CA 2-23-2 2023 was misissued because it contains the subject:organizationIdentifier attribut without the cabfOrganizationIdentifier extension. D-Trust confirmed the certificate contents but concluded that the cited EV Subscriber Certificate extension requirement did not apply to this subordinate CA certificate. The TLS Baseline Requirements applicable at issuance did not impose the alleged requirement.
• Incident Root Cause(s): N/A. The investigation identified no failure to comply with the applicable EV Guidelines, TLS Baseline Requirements, or certificate profile. The Preliminary Incident Report initially confirmed the reporter's conclusion before the complete scope analysis had been concluded.
• Remediation description: N/A. No certificate remediation or revocation was required. D-Trust has corrected the preliminary compliance assessment in this comment.
• Commitment summary: N/A. The certificate-content review and applicable-requirements analysis are complete. No ongoing commitments arise from the reported condition.

All Action Items disclosed in this report have been completed as described, and we request its closure.

D-Trust requests that this bug be closed as INVALID and that the \[ca-misissuance] classification be removed.

Comment 2

[incident-reporting]

This will be closed as "INVALID" on or about 2026-08-17.