Sectigo audit reports and related audit-document follow-up
This case is an audit-document thread that Sectigo opened to provide Mozilla with its WebTrust audit materials. It began in July 2018 when Sectigo said it had received its 2018 WebTrust reports shortly before the annual deadline but had not yet updated the CCADB because it was waiting for WebTrust seal URLs, so it attached the reports in Bugzilla. Mozilla then asked why the 2018 reports did not mention misissuances from that audit period, and Sectigo later said those events had not been disclosed to EY during audit evidence gathering; Sectigo said it amended its internal audit process for future cycles. The thread also records Sectigo's report that CPA Canada/WebTrust seal hosting changes affected direct access to seal URLs and the CCADB audit-letter validation process, after which Kathleen Wilson said the audit case could still be processed manually. In 2021, Ryan Sleevi pointed out that several attached audit PDFs displayed the title "SSLcom" in PDF metadata, and both Sectigo and its auditor responded that this came from inherited document metadata and said they would check for this in the future; Sectigo then attached replacement versions with the misleading titles stripped. After that, the bug continued to be used as a repository for later annual audit attachments, including 2019 through 2026 WebTrust reports and related key-generation and root audit documents. Since the previous summary, Sectigo added replacement 2026 audit-report attachments on 2026-07-01 for CA, NSR, BRSSL, EVSSL, Code Signing, and S/MIME. The bug remains resolved WORKSFORME.
- Sectigo received its 2018 WebTrust audit reports.
- Sectigo said it would submit its annual audit reports to the CCADB using Bugzilla attachment URLs.
- Sectigo said misissuance events from the audit period had not been disclosed to EY during audit evidence gathering and that it amended its internal audit process.
- Sectigo and its auditor said misleading "SSLcom" PDF titles came from inherited document metadata and would be checked in future.
- Sectigo attached replacement 2021 WebTrust reports with the misleading document titles stripped.
- Sectigo attached its 2026 WebTrust audit reports, including CA, NSR, BRSSL, EVSSL, Code Signing, S/MIME, and MC point-in-time documents.
- Sectigo attached replacement 2026 audit-report files for CA, NSR, BRSSL, EVSSL, Code Signing, and S/MIME.
- Sectigo — Sectigo opened the bug, said it had received the 2018 WebTrust reports but was still waiting for seal URLs, and attached the reports.
- Fastly representative — Wayne Thayer asked why the reports did not mention misissuances from the audit period and whether they had been disclosed to EY.
- Sectigo — Sectigo said new CPA Canada seal URLs had arrived and described problems with direct access to seal pages and audit-report downloads after the hosting change.
- Sectigo — Sectigo said it would stop waiting for clarification from the auditor and submit the annual audit reports to the CCADB using Bugzilla attachment URLs.
- Sectigo — Sectigo said the CCADB ALV tool reported that the audit letter was not found in a certified location and asked whether Mozilla and other operators would discuss this with WebTrust/CPA Canada.
- Mozilla representative — Kathleen Wilson said the audit case could still be processed by independently confirming authenticity with the auditor and noted that Wayne's question still needed an answer.
- Fastly representative — Wayne Thayer requested a response from Robin by 2018-08-03 regarding the missing misissuance discussion in the audit reports.
- Sectigo — Robin Alden apologized for the slow response and said he would work with the auditors to provide a full reply.
- Sectigo — Robin Alden said a substantive reply would be provided by the end of that week.
- Sectigo — Sectigo said the misissuances had not been disclosed to EY during audit evidence gathering, expressed regret, and said its internal audit process had been amended.
- Fastly representative — Wayne Thayer closed the bug and said it could be used to share future Comodo audit reports with Mozilla.
- Mozilla representative — Kathleen Wilson reopened the bug per email from Rob.
- Community commenter — Ryan Sleevi pointed out that several 2021 audit PDFs had the document title "SSLcom" and asked how that happened.
- Sectigo — Sectigo said it had asked its auditors about the PDF title issue and would add a review step to check PDF document titles.
- Bdo representative — The auditor said the PDF title came from inherited Microsoft Word metadata and that this would be checked in the future.
- Sectigo — Sectigo attached new versions of the 2021 WebTrust reports with the misleading document titles stripped.
- Mozilla representative — Ben Wilson attached USERTrust root audit documents, including copies saved without digital signatures and an ALV testing date-format file.
- Sectigo — Sectigo attached its 2026 WebTrust audit reports and a 2026 point-in-time MC document.
- Sectigo — Sectigo attached replacement 2026 audit-report files for CA, NSR, BRSSL, EVSSL, Code Signing, and S/MIME.