Sectigo: Failure to provide a preliminary report within 24 hours

This case involves Sectigo's failure to provide a preliminary report within the required 24-hour timeframe after receiving multiple Certificate Problem Reports regarding compromised keys. The issue was raised by Matt Palmer, who reported three incidents on February 26, 2020, but did not receive timely responses from Sectigo. After acknowledging the bug, Sectigo committed to providing an incident response and subsequently confirmed that the private keys in question were compromised and that the affected certificates would be revoked. The case was resolved with Sectigo implementing measures to improve their response times and processes for handling such reports.

1. 2020-02-26 Multiple Certificate Problem Reports were submitted to Sectigo regarding compromised keys.
2. 2020-03-06 Sectigo confirmed the compromise of the private keys and revoked the affected certificates.

1. 2020-03-02 Community commenter — Reported the failure to receive a preliminary report from Sectigo.
2. 2020-03-05 Sectigo — Acknowledged the bug report and committed to providing an incident response.
3. 2020-03-07 Sectigo — Provided a timeline of actions taken in response to the problem reports.
4. 2020-06-02 Sectigo — Described improvements made to their processes for handling key compromise reports.
5. 2020-07-08 Mozilla representative — Reviewed Sectigo's response and approach, finding it sufficient and adequate.