← Sectigo cases
Bugzilla #1698936
Delayed Revocation
Sectigo: ZeroSSL: failure to revoke within 24 hours
RESOLVED
FIXED
Sectigo
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
This case involves Sectigo's ZeroSSL failing to revoke a compromised certificate within the required 24-hour timeframe. The issue was reported when a user encountered an error while attempting to revoke the certificate through the ZeroSSL web portal. Following the report, the certificate was eventually revoked. However, Sectigo indicated that the proper revocation process was not followed, as the user contacted ZeroSSL directly instead of using the designated problem reporting mechanisms. The case was resolved with the certificate being revoked, and the discussion highlighted the need for clearer communication regarding the revocation process for certificates issued through ZeroSSL.
Chronology
- User reported failure to revoke a compromised certificate through ZeroSSL.
- ZeroSSL clarified its revocation process and updated its terms to reflect the relationship with Sectigo.
- Sectigo confirmed the certificate was revoked and addressed the confusion regarding the revocation process.
Thread Activity
- Marget representative — User reported an error when trying to revoke a certificate through ZeroSSL.
- Sectigo — Sectigo stated that the proper problem reporting mechanisms were not used.
- Sectigo — Sectigo confirmed that the certificate was revoked and clarified the revocation process.
Participants
Sectigo
Marget representative
Community commenter
Thisisntrocket representative
Mozilla representative
Zehetmayr representative
Stack representative
External References
Similar Local Cases
Sectigo: Failure to revoke key-compromised certificate within 24 hours
Sectigo: Failure to revoke within 5 days
Sectigo: Failure to revoke key-compromised certificates
Sectigo: Failure to revoke ECC certificates with non-DER encoded keyUsage within 5 days
Sectigo: Late revocation for incomplete Subject organizationName
Sectigo: Failure to properly respond to a report of subscriber key compromise
Firmaprofesional: Failure to revoke ICAs within 7 days: OCSP EKU
Sectigo: Failure to revoke within 24 hours