Sectigo: Failure to revoke within 5 days

This case involves Sectigo's failure to revoke two batches of mis-issued certificates within the required 5-day timeframe as mandated by the Baseline Requirements (BR). The issue was first reported to Sectigo on September 11, 2020, and while some certificates were revoked on September 17, others were not addressed until September 20, resulting in a delay. Sectigo acknowledged the oversight and attributed it to a combination of human error and system limitations. The CA has since revoked all affected certificates and is working on improving its processes to prevent future occurrences. The case has been resolved with all problematic certificates revoked.

1. 2020-09-11 Sectigo received a problem report detailing mis-issued certificates.
2. 2020-09-17 Some mis-issued certificates were revoked, one day late.
3. 2020-09-20 Remaining mis-issued certificates were revoked.

1. 2020-09-17 Sectigo — Sectigo has failed to revoke two batches of reported mis-issued certificates within the 5-day period required by the BR.
2. 2020-09-18 Sectigo — Sectigo provided a timeline of actions taken in response to the problem report.
3. 2020-09-20 Community commenter — Questioned why the overlooked batch wasn't revoked sooner.
4. 2020-10-03 Sectigo — Acknowledged the delay in revocation as a violation of the BR.
5. 2020-11-05 Mozilla representative — Scheduled the bug for closure unless further issues arise.