Sectigo: Failure to revoke within 24 hours

This case concerns Sectigo's failure to revoke certificates for the domain debigare.com within the required 24-hour timeframe after a request was made by the domain owner. The request was initially submitted on September 8, 2018, but the certificates were not fully revoked until September 13, 2018, resulting in a violation of the Baseline Requirements. Following the incident, Sectigo acknowledged the delay and provided an incident report detailing the timeline of events and their response. As a remediation step, Sectigo developed a self-service revocation portal to allow domain owners to revoke certificates more efficiently. The portal was released on August 18, 2019, with plans for further enhancements.

1. 2018-09-08 Domain owner requested revocation of certificates.
2. 2018-09-13 All affected certificates were finally revoked.
3. 2019-08-18 Sectigo released a self-service revocation portal.

1. 2018-09-18 Fastly representative — Reported a delay in certificate revocation beyond the required timeframe.
2. 2018-12-10 Sectigo — Provided a detailed incident report outlining the timeline of actions taken.
3. 2019-09-13 Sectigo — Announced the release of the self-service revocation portal.