Sectigo: Incomplete Subscriber Agreement provisions
Sectigo reported that during its annual WebTrust audit, the auditor noted it was possible to order a certificate through at least one retail storefront without being presented with the Sectigo Certificate Subscriber Agreement. Sectigo investigated and determined that a bug in the retail storefront purchase paths could fail to present the Certificate Subscriber Agreement, even though customers were required to agree to the Terms of Use. Sectigo stated that the issue did not directly affect certificate issuance, but affected the legal agreement between CA and subscriber. Sectigo remediated the problem by updating its website so that acceptance of the Subscriber Agreement is included in the Terms of Use whenever a certificate is purchased, and by updating the Terms of Use so the required obligations and warranties apply to all active certificate subscribers. Sectigo also concluded a comprehensive compliance review and reported that it found no further cases of the problem. The bug was marked RESOLVED with resolution FIXED.
- Sectigo demonstrated the OV certificate order and issuance process to its auditor.
- Sectigo received auditor questions about when the Subscriber Agreement is agreed during OV certificate ordering.
- Sectigo’s WIR team was informed of the auditor finding and began investigating.
- Sectigo deployed website changes to resolve the missing Subscriber Agreement presentation in affected purchase paths.
- Sectigo reported completion of a comprehensive compliance review with no further cases found.
- Sectigo — Martijn Katerbarg described how an annual WebTrust audit found that a retail storefront purchase path could omit presenting the Certificate Subscriber Agreement, and detailed Sectigo’s investigation and remediation steps.
- Sectigo — Martijn Katerbarg stated the incident was remediated and that a comprehensive compliance review found no further cases.
- Mozilla representative — Ben Wilson indicated he would close the bug on or about 5-Apr-2023 unless additional discussion was needed.
- Sectigo — Martijn Katerbarg agreed that, unless other comments were added, the incident should be considered resolved.