Sectigo: Inadequate DCV

Sectigo reported an incident regarding inadequate Domain Control Validation (DCV) that allowed the issuance of SSL certificates without proper validation for apex domains. The issue was identified following a report from a partner on February 10, 2021. Sectigo investigated and confirmed the flaw, leading to a code fix deployed on February 11, 2021. Affected certificates were identified, and notifications were sent to subscribers, resulting in the revocation of 1,548 certificates by February 19, 2021. The CA has since implemented measures to prevent similar issues in the future.

1. 2021-02-10 Sectigo received a report indicating inadequate DCV for apex domains.
2. 2021-02-11 Code fix deployed to prevent issuance of certificates without proper DCV.
3. 2021-02-19 Revocation of 1,548 affected certificates completed.

1. 2021-02-22 Sectigo — Sectigo created a detailed report outlining the incident and actions taken.
2. 2021-02-22 Community commenter — Inquired about the differences between this incident and a previous one involving Sectigo.
3. 2021-02-23 Sectigo — Explained the differences in scope and nature between the current and previous incidents.
4. 2021-03-22 Sectigo — Provided updates on ongoing discussions and actions regarding the incident.