Sectigo / Web.com: inconsistent disclosure of externally-operated intermediate

This case reports that Sectigo disclosed certain intermediates as being operated under the same CP/CPS as their parent, but that the same subject + SPKI appears in a Web.com root certificate with a different CP/CPS. The reporter provided multiple crt.sh links showing the intermediates and contrasted them with the Web.com root certificate link. Sectigo acknowledged the report and later stated that it updated the CCADB records for cross-certificates it issued to Web.com so that the Audit and CP/CPS details match what Web.com disclosed for its self-signed CA. Sectigo also added two new buckets to https://crt.sh/mozilla-disclosures to make such inconsistencies more apparent: “Disclosed, but with Inconsistent Audit details” and “Disclosed, but with Inconsistent CP/CPS details.” Sectigo explained that Sectigo and Web.com include the CA in their WebTrust audits because Sectigo runs “white label” services for Web.com, and that the arrangement has existed for 12 years or more. The thread concludes with a comment indicating remediation is complete, and the bug is resolved as FIXED.

1. 2019-07-18 A report was filed about inconsistent CP/CPS disclosure between Sectigo-disclosed intermediates and a Web.com root certificate.
2. 2019-09-13 Sectigo updated CCADB records and disclosure categorization to align Audit and CP/CPS details with Web.com’s disclosures.
3. 2019-09-16 The reporter confirmed that remediation appeared complete.

1. 2019-07-18 Mm representative — Reported that Sectigo disclosed intermediates under the parent’s CP/CPS, but the same subject+SPKI is present in a Web.com root certificate with a different CP/CPS, providing crt.sh links.
2. 2019-07-19 Community commenter — Acknowledged receipt and said Sectigo would provide an answer the following week.
3. 2019-09-10 Community commenter — Apologized for the slow response and said a response would be published by September 17.
4. 2019-09-13 Community commenter — Stated Sectigo updated CCADB records for cross-certificates to match Web.com’s disclosed Audit and CP/CPS details, and added two new crt.sh disclosure buckets for inconsistent Audit and CP/CPS details; also explained the Sectigo/Web.com “white label” and audit arrangement.
5. 2019-09-16 Fastly representative — Commented that all questions appeared answered and remediation was complete.