Sectigo: Failure to revoke certificate with previously-compromised key within 24 hours

Sectigo faced a compliance issue regarding the timely revocation of a certificate that utilized a previously compromised key. The incident was reported on March 20, 2020, when a notification was sent to Sectigo about the compromised key. Although the certificate was revoked on the same day, a new certificate was issued shortly after using the same compromised key, which raised concerns about adherence to Mozilla's policies. Sectigo acknowledged the oversight and has since implemented measures to ensure that certificates using compromised keys are revoked within 24 hours.

1. 2020-03-20 Certificate using compromised key was reported and subsequently revoked.
2. 2020-03-23 New certificate issued using the same compromised key.
3. 2020-04-03 Sectigo provided an incident report detailing the timeline and actions taken.