← Sectigo cases
Bugzilla #1639804
Revocation Issue
Delayed Revocation
Sectigo: Failure to revoke key-compromised certificate within 24 hours
RESOLVED
FIXED
Sectigo
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
This case concerns Sectigo's failure to revoke a certificate linked to a compromised key within the required 24-hour timeframe. The issue was reported on May 13, 2020, and the revocation was not completed until May 15, 2020. Sectigo acknowledged the delay and attributed it to staffing challenges exacerbated by COVID-19, which affected their ability to process problem reports in a timely manner. Following discussions in the thread, Sectigo has committed to accepting key compromise reports via email again, alongside their existing automated mechanisms. The case has been resolved with a commitment to improve their response processes.
Chronology
- A certificate problem report was received regarding a compromised key.
- The compromised certificate was revoked.
Thread Activity
- Hezmatt representative — Reported the failure to revoke the compromised certificate within the required timeframe.
- Sectigo — Acknowledged the report and promised to follow up.
- Sectigo — Confirmed that Sectigo will accept key compromise reports via email again.
Participants
Hezmatt representative
Sectigo
WoSign CA Limited
Community commenter
Mozilla representative
External References
Similar Local Cases
Sectigo: Failure to revoke key-compromised certificates
Sectigo: Failure to revoke within 5 days
Sectigo: ZeroSSL: failure to revoke within 24 hours
Sectigo: Failure to revoke certificate with previously-compromised key within 24 hours
Sectigo: Failure to properly respond to a report of subscriber key compromise
GoDaddy: Failure to revoke certificate with compromised key within 24 hours
Sectigo: Failure to revoke ECC certificates with non-DER encoded keyUsage within 5 days
Sectigo: Late revocation for incomplete Subject organizationName