Open Bug 2062202 Opened 6 days ago Updated 5 days ago

Sectigo: jurisdictionCountry versus organizationIdentifier mismatch in QWAC

Categories

(CA Program :: CA Certificate Compliance, task)

Product:
CA Program
Component:
CA Certificate Compliance
Type:
task

Tracking

(Not tracked)

Status:
ASSIGNED

People

(Reporter: martijn.katerbarg, Assigned: martijn.katerbarg)

Details

(Whiteboard: [ca-compliance] [ev-misissuance])

Preliminary Incident Report

Summary

  • Incident description:

    On August 7, 2026 we received a Certificate Problem Report pointing to one QWAC certificate that had a mismatch between the JOI country of the organization and the ISO 3166 country code included in the Organization Identifier subject attribute. Specifically, the jurisdictionCountry and other organization information correctly identifies the company as being French, while organizationIdentifier contains a German two-digit country code in the listed Registration Scheme.

    We concur that this certificate was misissued and intend to complete revocation within the allocated timespan. We are investigating our corpus of certificates for additional instances of this error and will publish a Full Incident Report within prescribed timelines.

  • Relevant policies: EV TLS Server Certificate Guidelines version 2.0.3 – Section 7.1.4.2.8

  • Source of incident disclosure: Third party reported

Assignee: nobody → martijn.katerbarg
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true
Whiteboard: [ca-compliance] [ev-misissuance]
You need to log in before you can comment on or make changes to this bug.