Sectigo delayed preliminary reports for two certificate problem reports
This case concerns two certificate problem reports sent to Sectigo that did not receive a preliminary report within 24 hours. The reporter said they emailed Sectigo’s SSL abuse address on 2020-06-24 about two certificates with incorrect subject information, and only received acknowledgements at first. Sectigo later confirmed it investigated the reports, revoked both certificates on 2020-06-29, and sent incident-report details describing the timeline and the revocations. The thread then focused on why the reporter was not sent a preliminary report in time and whether Sectigo’s handling reflected a broader process issue. Sectigo said the miss was human error, described planned automation to improve reporting and revocation workflows, and later stated that the first round of revocation-portal improvements had gone live. The bug was resolved, and participants discussed closing it after Sectigo reported that the original matter had been resolved and that further bulk-revocation work was being tracked separately.
- Two problem reports were sent to Sectigo about certificates with incorrect subject information.
- Both affected certificates were revoked.
- Sectigo said the first round of revocation-portal improvements had gone live.
- Mozilla indicated the matter could be closed.
- Fozzie representative — The reporter said Sectigo had acknowledged receipt but had not provided a preliminary report within 24 hours.
- Sectigo — Sectigo said it was investigating and would respond in Mozilla’s preferred incident-report format if the issue checked out.
- Sectigo — Sectigo provided an incident report with timelines for both certificates, including acknowledgements, revocation dates, and follow-up emails.
- Fozzie representative — The reporter said the responses received were not preliminary reports and asked why the required report was not sent.
- Sectigo — Sectigo said the preliminary report was not sent within 24 hours and attributed the failure to human error on two reports handled by the same staff member.
- Sectigo — Sectigo said it was investigating customer-service system changes and might combine the response with bug 1650845.
- Sectigo — Sectigo said the revocation workflow specification was mostly finalized and that the changes would automate reporting and revocation timing.
- Sectigo — Sectigo said the improvements to revocation processing should be live by the end of November.
- Sectigo — Sectigo said the first round of revocation-portal improvements had gone live and more work was planned.
- Sectigo — Sectigo said the original matter had been resolved for months and asked whether the bug could be closed.
- Mozilla representative — Mozilla said it intended to close the bug on or about 2021-03-31.