Sectigo: Use of forbidden subjectPublicKeyInfo algorithm

This case involves Sectigo's discovery of the issuance of certificates using the forbidden P-521 public key algorithm, which violates Mozilla's CA policy. The issue was first reported in the mozilla.dev.security.policy forum, prompting Sectigo to investigate and disclose the incident. Sectigo implemented a code change to prevent further issuance of such certificates and conducted a compliance review, identifying additional issues related to RSA key sizes. The CA has committed to improving its QA processes and has provided a timeline for remediation. The case is now resolved with the necessary actions taken.

1. 2019-01-08 Sectigo discovered the issuance of certificates with the P-521 public key algorithm.
2. 2019-07-22 Sectigo implemented a further code change to prevent issuance of certificates with P-521 keys.

1. 2019-01-08 Community commenter — Reported problems with certificates issued by Sectigo, requesting an incident report.
2. 2019-01-09 Sectigo — Confirmed immediate code change to stop issuing certificates with P-521 keys.
3. 2019-02-21 Sectigo — Identified additional compliance issues regarding RSA key sizes.
4. 2019-08-02 Sectigo — Confirmed final remediation actions and improvements to QA processes.
5. 2019-08-10 Fastly representative — Noted that all questions have been answered and remediation is complete.