Sectigo: Failure to revoke key-compromised certificates

This case involves Sectigo's failure to revoke certificates that were reported as compromised within the required 24-hour timeframe. Between May 7 and May 9, 2020, multiple reports were submitted to Sectigo regarding compromised private keys, but the certificates remained valid in OCSP responses even after the reports were received. Following internal reviews, Sectigo acknowledged a broken process and subsequently revoked the affected certificates on June 1, 2020. The CA has since implemented changes to its revocation process to ensure timely action on future key compromise reports.

1. 2020-05-07 Reports of key compromise submitted to Sectigo.
2. 2020-06-01 Affected certificates were revoked.

1. 2020-05-21 Hezmatt representative — Reported multiple instances of key compromise and lack of revocation.
2. 2020-06-01 Sectigo — Acknowledged the issue and confirmed revocation of affected certificates.
3. 2020-08-21 Sectigo — Outlined steps taken to address the revocation process failures.
4. 2020-09-01 Mozilla representative — Indicated intention to close the bug unless further issues arise.