← Sectigo cases
Bugzilla #1714628
Incident
Self Reported Incident
Sectigo: Forbidden Domain Validation Method
RESOLVED
FIXED
Sectigo
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Sectigo disclosed a compliance issue regarding their Domain Control Validation (DCV) methods, specifically that their Certificate Policy Statement (CPS) was not fully updated to reflect supported DCV methods. This was identified during a review triggered by a previous bug report. Sectigo acknowledged the oversight and initiated a comprehensive review of their DCV processes, leading to the revocation of 369,922 affected certificates. The updated CPS was published on May 21, 2021, and the revocation process was completed by June 10, 2021. The CA has committed to improving their compliance processes to prevent similar issues in the future.
Chronology
- Bug opened by Ryan Sleevi to track the compliance issue.
- Updated CPS published to reflect all in-production DCV methods.
- Revocation of all affected certificates completed.
Thread Activity
- Community commenter — Sectigo disclosed that they had not kept their list of supported DCV methods fully up to date.
- Sectigo — Acknowledged the bug and stated it would be used to track the update and corresponding certificate revocations.
- Sectigo — Provided details on the timeline of actions taken in response to the issue.
- Community commenter — Expressed willingness to consider the issue resolved while highlighting concerns about prioritization.
- Sectigo — Reiterated commitment to improving issuance quality and compliance measures.
Participants
Community commenter
External References
Similar Local Cases
Sectigo: Incorrect locality information
Sectigo: Incorrect EV businessCategory
Sectigo: "Default City" in Subject:localityName
Sectigo: "Some-State" in stateOrProvinceName
Sectigo: Failure to provide a preliminary report within 24 hours
Sectigo: DCV Reuse after 825 days
Sectigo: invalid subject:organizationalUnitName on DV certificates
Sectigo: Misspellings in stateOrProvince or localityName fields