Sectigo non-revocation of DV certificates containing subject:organizationalUnitName

Sectigo opened this bug to disclose that it had issued a large number of DV SSL certificates containing subject:organizationalUnitName and had decided not to revoke them immediately. Sectigo said it believed the BR language in section 7.1.4.2.2(i) was unclear or misdrafted, and initially planned to let the certificates expire naturally while it worked on a CA/B Forum ballot to clarify the wording. Mozilla and other commenters pushed back, asking for a clearer revocation plan and more concrete remediation. Sectigo later said it would revisit the report, provided counts of affected certificates, and described bulk revocations and natural expiry over time. By November 2020, Sectigo reported 737,637 revocations for certs under wd2go.com and said it was working with Western Digital to migrate to 90-day certificate duration. The bug was later marked RESOLVED with FIXED, and Mozilla indicated it was inclined to close the matter after adequate discussion.

1. 2020-03-06 Sectigo disclosed DV certificates issued with subject:organizationalUnitName and said it would not immediately revoke them.
2. 2020-05-19 Sectigo reported millions of affected certificates, with many already expired and some already replaced and revoked.
3. 2020-08-04 Sectigo said about 4.8 million valid certificates remained and that around 700,000 might be revocable for one partner.
4. 2020-11-02 Sectigo processed 737,637 revocations for certificates issued under wd2go.com and said it was working to move to 90-day certificates.
5. 2021-01-22 Mozilla said it was inclined to close the matter as having had adequate discussion.

1. 2020-03-06 Sectigo — Sectigo said it had stopped including OU fields in DV certificates and opened the bug because it would not revoke the affected certificates immediately.
2. 2020-03-06 Community commenter — Ryan said Sectigo’s response lacked data and asked it to revisit the report and explain how it would prevent future delays.
3. 2020-03-11 Sectigo — Sectigo said it would revisit the report and provide more analysis on the affected certificates.
4. 2020-05-19 Sectigo — Sectigo reported expiry, replacement, and revocation counts, and said some certificates were on consumer devices that could not be updated before expiry.
5. 2020-06-03 Sectigo — Sectigo said it would propose a CA/B Forum ballot to restate 7.1.4.2.2(i) more clearly.
6. 2020-07-28 Sectigo — Sectigo said it would provide an update after a meeting with a subscriber holding most of the affected certificates.
7. 2020-08-04 Sectigo — Sectigo said about 4.8 million valid certificates remained, most with one partner, and that revocation was limited by device impact.
8. 2020-08-26 Sectigo — Sectigo said the devices had no remote software update mechanism and that revocation would require manual firmware update or factory reset.
9. 2020-11-02 Sectigo — Sectigo said it had processed 737,637 revocations for wd2go.com and was working with Western Digital on 90-day certificate duration.
10. 2021-01-22 Mozilla representative — Mozilla said it was inclined to close the matter as having had adequate discussion.