Sectigo: Failure to properly respond to a report of subscriber key compromise

Sectigo faced a challenge in responding to a report of a compromised subscriber key. The report was submitted on May 1, 2020, but Sectigo did not initially acknowledge it as valid, leading to delays in revocation of the affected certificate. After further communication and investigation, the certificate was ultimately revoked on May 6, 2020. The incident raised concerns about the speed of response to revocation requests, although it was documented and remediated appropriately.

1. 2020-05-01 Sectigo received a report of a compromised subscriber key.
2. 2020-05-06 Sectigo revoked the certificate in question.
3. 2020-07-08 Incident was closed after appropriate documentation and remediation.