2062100 - DigiCert: jurisdictionCountry in EV certificate

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[DigiCert]

Preliminary Incident Report

Summary

• Incident description: A community member reported to DigiCert that the jurisdictionCountry attribute in an Extended Validation (EV) Subscriber certificate was inconsistent with the expected Subject country attribute.
• Relevant policies: Guidelines for the Issuance and Management of Extended Validation Certificates (v2.0.3, effective 2026-07-06), Section 7.1.4.2.
• Source of incident disclosure: Third Party Reported

Comment 1

[DigiCert]

DigiCert will post the Full Incident Report on or before 2026-08-21.

Comment 2

[DigiCert]

Full Incident Report

Summary

• CA Owner CCADB unique ID: A000021

• Incident description: We received a Certificate Problem Report (CPR) noting that the jurisdictionCountryName of an EV certificate did not match the ISO 3166-1 country code in the NTR registration scheme identifier in organizationIdentifier. The affected certificate is an EV certificate that is also a Qualified Web Authentication Certificate (QWAC).

  The organizationIdentifier value is NTRFR-419 964 010. Under the EV Guidelines an NTR registration scheme identifier carries a +-prefixed ISO 3166-2 subdivision component only where the jurisdiction of registration extends below the country level. No subdivision component is present and the country component is FR. Both are consistent with the underlying registration.

  The jurisdiction attributes instead asserted Guadeloupe as a country-level jurisdiction, with jurisdictionCountryName=GP and both jurisdictionStateOrProvinceName and jurisdictionLocalityName populated. Guadeloupe is a French département d'outre-mer and the tribunal de commerce that recorded this registration sits in Basse-Terre. The correct value is jurisdictionCountryName=FR with no state or province and no locality.

  The certificate's stateOrProvinceName and localityName describe the Subscriber's place of business rather than its jurisdiction of registration. Those values were correct and are not affected.

  We corrected the logic that populates the jurisdiction attributes and searched our full EV corpus for this class of error rather than only French cases.

• Timeline summary:

  • Non-compliance start date: 2026-02-12, issuance of the earliest affected certificate
  • Non-compliance identified date: 2026-08-07, receipt of the CPR
  • Non-compliance end date: 2026-08-12, completion of revocation

• Relevant policies:

  • CA/Browser Forum Guidelines for the Issuance and Management of Extended Validation Certificates, v2.0.3, Section 7.1.4.2.4 "Subject Jurisdiction of Incorporation or Registration Field", Section 7.1.4.2.8 “Subject Organization Identifier Field”.
  • ETSI EN 319 412-1 clause 5.1.4, defining the NTR scheme and its country component, and ETSI EN 319 411-2 (QCP-w), under which the EVG subject identity requirements apply to QWACs.

• Source of incident disclosure: Third Party Reported

Impact

• Total number of certificates: 3
• Total number of "remaining valid" certificates: 0
• Affected certificate types: EV
• Incident heuristic: A third party can reproduce our corpus from public CT data by identifying our EV certificates whose jurisdictionCountryName is set to a French Outremer ISO 3166-1 code (for example GP, MQ, GF, RE, YT) while the organizationIdentifier encodes the French national trade register (prefix NTRFR).
• Was issuance stopped in response to this incident, and why or why not?: No. The defect was narrowly scoped. Once the root cause was identified, the validation logic was corrected and the full scope was confirmed to be three certificates, with no indication of a broader systemic issuance failure. A general halt to issuance was therefore not warranted.
• Analysis: N/A. This incident is not a revocation-delay incident.
• Additional considerations: One of the affected certificates is an EU QWAC; we have notified the relevant Supervisory Body.

Timeline

• 2026-02-12 00:00 UTC – first affected certificate issued.
• 2026-02-19 00:00 UTC – second affected certificate issued.
• 2026-07-22 00:00 UTC – third affected certificate issued (later reported).
• 2026-08-07 15:21 UTC – CPR received.
• 2026-08-07 15:49 UTC – CPR acknowledged.
• 2026-08-07 19:53 UTC – investigation opened; mis-issuance confirmed.
• 2026-08-07 23:45 UTC – validation logic corrected and deployed; French overseas territory handling confirmed.
• 2026-08-08 13:27 UTC – Corpus-wide search completed, including Outre-mer scope; two additional affected certificates identified (total of three).
• 2026-08-12 15:10 UTC – revocation completed (non-compliance ended).

Related Incidents

Bug	Date	Description
1898848 / 1897630	2024-06	Entrust: Jurisdiction issue in EV TLS and Code Signing certificates.
1798626	2022-08	SHECA/UniTrust: EV certificate with wrong registry country name; jurisdictionCountryName set to an incorrect default and inconsistent with `jurisdictionStateOrProvinceName.
1802916	2022-11	Entrust: 322 EV TLS certificates mis-issued with incorrect jurisdiction; documents the difficulty of constructing a simple search heuristic when place-of-business and jurisdiction fields legitimately differ.
1747915	2021-12	Sectigo (Xolphin): Incorrect JOI country value; externally reported mismatch between jurisdictionCountryName and the selected registration source.
1696227	2021-03	Entrust, jurisdictionCountryName set to ZA where it should have been BW. The closest precedent for a wrong country code as opposed to superfluous sub-national attributes.
1575022	2019-08	Sectigo: EV SSL certificates with incorrect subject details. Conceptually the closest precedent: legal analysis confirmed that for national-level registrations (there, German Private Organizations) the jurisdiction is at the country level and state/locality must not be present.

Root Cause Analysis

The French overseas departments include:

• GP: Guadeloupe
• MQ: Martinique
• GF: French Guiana (Guyane)
• RE: Réunion
• YT: Mayotte
  All five have codes in ISO 3166-1, listed as independent entries in the standard even though these territories are integral parts of the French Republic.

Contributing Factor 1: Jurisdiction attributes derived from location of the recording office rather than the legal scope of the Registration Agency

• Description: Our logic treated the geographic location of the office holding the registration record as the jurisdiction of registration. For this Subscriber that office is the tribunal de commerce in Basse-Terre. Because Guadeloupe holds its own ISO 3166-1 code, the logic emitted jurisdictionCountryName=GP and populated state and locality. The correct test is which authority's law creates the registration, not where the record sits. The overseas département registration is created under French national law and held in the Registre National des Entreprises operated registry.
• Timeline: The logic was in place at the time the affected certificates were issued.
• Detection: Externally submitted CPR. It escaped internal detection because there was no automated pre-issuance rule comparing these two fields, and because the sub-national geography of French overseas departments was treated as a distinct country-level jurisdiction rather than mapped to FR.
• Interaction with other factors: Combined with CF# 3 (absence of a consistency check), the geographic derivation error was able to flow through to issuance uncaught.
• Root Cause Analysis methodology used: 5 Whys.

Contributing Factor 2: The Registration Agency to jurisdiction mapping was maintained without a recorded legal-basis determination per agency

• Description: Although our lists of Authorized Sources for EV were accurate, in the case of the overseas départements, their national associations were not correctly allocated.
• Interaction with other factors: Origin of the defective entry in CF#1.
• Methodology: 5 Whys.

Contributing Factor 3: No pre-issuance consistency check between the jurisdiction attributes and organizationIdentifier

• Description: There was no automated check verifying the match of jurisdictionCountryName to the ISO 3166-1 country encoded in organizationIdentifier.
• Timeline: Present for the full period during which the affected certificates were issued.
• Detection: Visible only upon external report.
• Interaction with other factors: This gap is what allowed the erroneous output of CF# 1 to reach issuance without human or automated interception.
• Root Cause Analysis methodology used: 5 Whys.

Contributing Factor 4. Post-issuance monitoring of our EV corpus did not test jurisdiction consistency.

• Description: The defect was found by a third party reading CT rather than by us. Neither self-monitoring nor EV self-audit sampling tested jurisdiction consistency, so the only available detection path was external.
• Interaction with other factors: The reason months passed between CF#1's first effect and detection.
• Methodology: 5 Whys.

Lessons Learned

• What went well: The CPR was triaged and the mis-issuance was confirmed quickly. The root cause localized cleanly to a single validation behavior, and a corrective fix was developed and deployed.
• What didn't go well: The validation logic conflated the location of the registering court with the legal jurisdiction of the registration authority, so entities registered through overseas-department courts were assigned an overseas-territory country code and superfluous state/locality values.
• Where we got lucky: The number of affected certificates was small.
• Additional: Our pre-issuance linting did not include a rule tying jurisdictionCountryName to the ISO 3166 country in organizationIdentifier.

Action Items

#	Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
1	Correct the validation logic so that jurisdiction of incorporation fields are derived from the legal scope of the registration authority, and map all French overseas territory codes (GP, MQ, GF, RE, YT, and the collectivities) to the correct jurisdiction.	Prevent	CF#1, CF#2	Corrected logic deployed to production; no further certificates issued with an overseas-territory jurisdictionCountryName where registration is national.	2026-08-07	Complete
2	Add a pre-issuance control when jurisdictionCountryName does not equal the ISO 3166-1 country encoded in organizationIdentifier.	Prevent	CF#3	Control live in the issuance pipeline; test certificates with the defect are rejected pre-issuance; control covered by automated test.	2026-08-14	Complete
3	Add a linting / periodic CT-scan rule that flags issued EV certificates whose jurisdiction fields are inconsistent with organizationIdentifier.	Detect	CF #4	Rule runs on new issuance and on a recurring scan of our EV corpus; alerts on any match.	2026-08-31	Ongoing

Appendix

Comment 3

[DigiCert]

Attachment: Bugzilla_JOI_dossier.csv

Comment 8

[DigiCert]

We are continuing to work on the final Action Item and will provide an update on or before 2026-08-31.

Comment 9

[DigiCert]

DigiCert has completed Action Item #3 to add a linting / periodic CT-scan rule that flags issued EV certificates whose EV JOI fields are inconsistent with their included organizationIdentifier.

Comment 10

[DigiCert]

Report Closure Summary

• Incident description: DigiCert received a CPR identifying an EV TLS certificate (also an eIDAS QWAC) whose jurisdictionCountryName did not match the ISO 3166-1 country code in the NTR registration scheme identifier of organizationIdentifier (NTRFR-419 964 010). The certificate asserted Guadeloupe as a country-level jurisdiction (jurisdictionCountryName=GP, with jurisdictionStateOrProvinceName and jurisdictionLocalityName populated) when the registration was created under French national law, so the correct encoding was jurisdictionCountryName=FR, per EVG v2.0.3 Sections 7.1.4.2.4 and 7.1.4.2.8. A corpus-wide search identified three affected EV certificates in total; all three were revoked, with revocation completed on 2026-08-12, and no affected certificates remain valid.

• Incident Root Cause(s): The validation logic derived the jurisdiction of incorporation fields from the geographic location of the office holding the registration record (the tribunal de commerce in Basse-Terre, in a département d'outre-mer) rather than from the legal scope of the Registration Agency. This defect reached issuance and remained undetected because there was no pre- or post- issuance consistency check between the jurisdiction attributes and organizationIdentifier.

• Remediation description: All three Action Items are complete. (1) The validation logic was corrected on 2026-08-07 so that jurisdiction of incorporation fields are derived from the legal scope of the registration authority, with all French overseas territory codes (GP, MQ, GF, RE, YT, and the collectivities) mapped to the correct jurisdiction, and the full EV corpus was searched for this class of error. (2) A pre-issuance control now blocks issuance when jurisdictionCountryName does not equal the ISO 3166-1 country encoded in organizationIdentifier. (3) A linting / periodic CT-scan rule now flags issued EV certificates whose jurisdiction fields are inconsistent with organizationIdentifier. The three affected certificates were revoked by 2026-08-12, and the relevant EU Supervisory Body was notified regarding the affected QWAC.

• Commitment summary: Beyond the completed Action Items, we will treat jurisdiction-of-incorporation encoding for subdivisions with independent ISO 3166-1 codes as a standing review item when maintaining our Registration Agency mappings and Authorized Sources for EV.

All Action Items disclosed in this report have been completed as described, and we request its closure.

Comment 11

[incident-reporting]

This is a final call for comments or questions on this Incident Report.

Otherwise, it will be closed on approximately 2026-09-15.