Sectigo: Incorrect locality information

Sectigo identified two certificates issued with incorrect localityName and postalCode information during an internal audit on May 6, 2021. Both certificates were issued to the same organization and contained identical errors. Following the discovery, Sectigo scheduled the revocation of the certificates, which occurred on May 10, 2021. The CA has since removed the RA privileges of the partner responsible for the erroneous certificates and is implementing measures to prevent similar issues in the future. The incident has been resolved with the certificates revoked and the partner's RA privileges removed.

1. 2021-05-06 Internal audit discovers two certificates with incorrect locality and postal code information.
2. 2021-05-10 Both certificates are revoked.
3. 2021-06-15 RA privileges of the partner responsible for the erroneous certificates are removed.

1. 2021-06-02 Sectigo — Sectigo's internal audit team discovered two certificates with incorrect localityName and postalCode information.
2. 2021-06-02 Thisisntrocket representative — Requested clarification on how the certificates were discovered and why it took time to report the issue.
3. 2021-06-07 Sectigo — Explained the timeline and reasons for the delay in reporting the issue.
4. 2021-06-16 Sectigo — Confirmed the removal of RA privileges as scheduled.
5. 2021-06-30 Sectigo — Provided updates on the compliance process and the status of the RA partner.
6. 2021-07-12 Community commenter — Inquired about the RA partner's suggestions and the implications for RA management.
7. 2021-07-16 Sectigo — Clarified that no incident report was required from the RA partner and discussed the future of their privileges.
8. 2021-07-26 Mozilla representative — Indicated intention to close the matter.