Sectigo: Missing changelog in CPS

This case concerns Sectigo’s Certificate Practice Statement (CPS) lacking an apparent changelog, which Mozilla Root Store Policy requires. The issue was raised in this Bugzilla report after Wayne Thayer opened bug 1545208 on 2019-04-17, citing Mozilla Root Store Policy section 3.3 and pointing to Sectigo’s CPS v5.0 PDF. Sectigo stated that internal compliance review processes had missed the introduction of the requirement for a dated changelog entry when Mozilla policy version 2.5 was introduced, and that they created CPS v5.1.1 (and later v5.1.2) including a changelog reaching back to version 5.0. Sectigo also stated it would maintain the changelog for each CPS update going forward and published updated CPS documents, including a later CPS revision v5.1.4. Robin Alden later confirmed the compliance review was completed on 2019-07-17 and that the CPS update went live on 2019-08-15, providing a link to the updated CPS v5.1.4. The reporter indicated on 2019-09-18 that remediation appeared complete, and the bug is resolved as FIXED.

1. 2019-04-17 Wayne Thayer opened Bug 1545208 reporting that Sectigo’s CPS v5.0 lacked an apparent required changelog.
2. 2019-04-23 Sectigo created CPS v5.1.1 with a changelog reaching back to version 5.0 after identifying the missing requirement.
3. 2019-04-24 Sectigo published CPS v5.1.1 as the current CPS version.
4. 2019-05-06 Sectigo approved and published CPS v5.1.2, updating the changelog.
5. 2019-07-17 Sectigo completed a compliance review related to Mozilla policy compliance and CPS statements.
6. 2019-08-15 Sectigo published CPS v5.1.4 on its website, including the changelog update.
7. 2019-09-18 The reporter indicated remediation appeared complete after the CPS update link was provided.

1. 2019-04-17 Fastly representative — Wayne Thayer reported that Sectigo’s CPS v5.0 had no apparent changelog as required by Mozilla Root Store Policy section 3.3 and asked for an explanation or an incident report.
2. 2019-07-04 Community commenter — Ryan Sleevi noted another Sectigo incident had gone unresponded to for a long period of time.
3. 2019-07-12 Sectigo — Robin Alden provided a detailed response including how Sectigo became aware, a timeline of CPS updates (v5.1.1/v5.1.2), and explanations about why the changelog requirement was missed.
4. 2019-07-19 Sectigo — Robin Alden said they did not yet have confirmation the compliance review was completed and would confirm early the next week.
5. 2019-08-02 Sectigo — Robin Alden confirmed the compliance review was completed on 2019-07-17 and said a further CPS revision was being prepared to include expanded statements and a changelog entry.
6. 2019-08-14 Sectigo — Robin Alden said the CPS update would be live in the next couple of days.
7. 2019-09-17 Fastly representative — Wayne Thayer asked whether the CPS had been updated and requested a link.
8. 2019-09-17 Sectigo — Robin Alden provided a link stating the CPS revision went live on 2019-08-15: https://sectigo.com/uploads/files/Sectigo-CPS-v5.1.4.pdf
9. 2019-09-18 Fastly representative — Wayne Thayer stated it appeared all questions had been answered and remediation was complete.