← Sectigo cases
Bugzilla #1718771
Certificate Problem Report
Sectigo: DCV Reuse after 825 days
RESOLVED
FIXED
Sectigo
AI Summary
Sectigo identified issues related to Domain Control Validation (DCV) reuse beyond the maximum period of 825 days, leading to the revocation of over 96,000 certificates. The investigation revealed complexities in tracking DCV methods due to multiple factors, including the nature of certificate requests from resellers and hosting providers. Sectigo undertook a comprehensive review of its DCV processes, resulting in the implementation of an audit script to identify affected certificates. The case highlights the challenges of ensuring compliance with best practices in certificate issuance and domain control.
Chronology
- Initial awareness of DCV reuse issues announced.
- Revocation of 96,002 certificates with DCV reuse beyond 825 days.
- Completion of DCV misissuance research with no additional revocations pending.
Participants
Rob Stradling
Tim Callan
Ryan Sleevi
Matthias
External References
Similar Local Cases
Sectigo: Incorrect locality information
Sectigo: CPR response issues
Sectigo: Failure to provide timely incident reports
Sectigo: OCSP responses directly signed using root certificates without KU=digitalSignature
Sectigo: Lack of input validation in stateOrProvinceName
Sectigo: Misspellings in stateOrProvince or localityName fields
Sectigo: Failure to block disallowed LDH labels in domain names
Sectigo: Inadequate DCV