Re: Certificates with subject stateOrProvinceName "Some-State"

As reported earlier this is the link to bugzilla: https://bugzilla.mozilla.org/show_bug.cgi?id=1551364 Thank you Timo (SwissSign) ___ dev-security-policy mailing list dev-security-policy@lists.mozilla.org

Re: Certificates with subject stateOrProvinceName "Some-State"

Thanks for reporting this Alex. I have created the following bugs to track these issues: Sectigo: https://bugzilla.mozilla.org/show_bug.cgi?id=1551362 DigiCert: https://bugzilla.mozilla.org/show_bug.cgi?id=1551363 SwissSign: https://bugzilla.mozilla.org/show_bug.cgi?id=1551364 Government of

AW: Certificates with subject stateOrProvinceName "Some-State"

Hi Alex, Thank you for reporting this issue. The certificates will be revoked in accordance with BR 4.9.1.1. We will provide an incident report after the internal investigation is finished. Kind regards, Arnold ___ dev-security-policy mailing list

RE: Certificates with subject stateOrProvinceName "Some-State"

Hi Alex, Thank you for reporting this issue. The certificate has been revoked. We will provide an incident report after the internal investigation is finished. Kind regards, Cristian Garabet  CISO Sent from my Samsung Galaxy smartphone.

Certificates with subject stateOrProvinceName "Some-State"

Inspired by Nick Lamb's comment a week or so ago on m.d.s.p about "Default City" being an OpenSSL default value in CSRs, I ran some more searches on the OpenSSL defaults and found almost 100 certificates with a stateOrProvinceName of "Some-State". BR section 7.1.4.2.2(f) requires this field to be