Sectigo: Late revocation for incomplete Subject organizationName
Sectigo reported a revocation delay affecting 18 certificates that were due to be revoked on February 19, 2023. In the thread, Sectigo says it decided during its twice-weekly WebPKI Incident Response (WIR) team call to grant a delay after it failed to send revocation notifications to customers in a timely manner. Sectigo rescheduled the revocation for February 22 at 03:00 AM, and later stated the 18 certificates were revoked on February 22 at 03:21 UTC. Sectigo also described remediation by scoping and drafting changes to automate notifications, with development and deployment planned on a roadmap and later released for future revocation events. By June 26, 2023, Sectigo stated automated notifications were available for future revocation events and that this concluded remediation. Mozilla indicated it would close the bug on June 28, 2023 unless further issues were raised, and the bug is resolved as FIXED.
- Sectigo’s planned revocation for 18 certificates was delayed after notification failures to customers.
- The 18 affected certificates were revoked (03:21 UTC).
- Sectigo reported automated notifications were available for future revocation events, concluding remediation.
- Sectigo — Sectigo explained it granted a revocation delay for 18 certificates due to failing to send timely notifications, and provided the incident timeline and affected certificates.
- Sectigo — Sectigo confirmed the 18 certificates were revoked on February 22 at 03:21 UTC and asked to keep the bug open until its remediation plan was in effect.
- Sectigo — Sectigo reported it had scoped and drafted required changes to automate notifications and requested a next update for May 31, 2023.
- Sectigo — Sectigo stated development had commenced and planned a release by June 26, 2023, requesting a next update for that date.
- Sectigo — Sectigo reported automated notifications were available for future revocation events and requested closing the bug.
- Mozilla representative — Mozilla said it would close the bug on Wed. June 28, 2023 unless further issues were discussed.