Sectigo: Reseller ZeroSSL and Private Key Generation

This case discusses the private key generation and storage practices of ZeroSSL, a reseller of Sectigo. Concerns were raised regarding whether ZeroSSL's method of generating and storing private keys complies with Mozilla's Root Store Policy. The discussion highlighted that private keys are generated client-side and encrypted before being sent to ZeroSSL's servers. However, questions about the security of this process and the implications of storing encrypted private keys were debated. Ultimately, the case was closed as invalid after it was determined that the processes in place do not expose private keys improperly.

1. 2021-03-19 Initial concerns raised about ZeroSSL's private key generation process.
2. 2021-03-29 Further discussions on the security of ZeroSSL's practices.
3. 2021-03-31 Case closed as invalid after review.