Sectigo / SSL.com: Late disclosure of updated SSL.com CP/CPS to CCADB

Sectigo disclosed a compliance incident involving sixteen CCADB records for Cross-Certified Subordinate CA Certificates it issued to SSL.com. Sectigo said it has an ongoing duty to keep those CCADB records up to date, but SSL.com did not notify Sectigo promptly after publishing SSL.com CP/CPS v1.21 and v1.22. Sectigo determined that, by the time it became aware, the updated CP/CPS information was already disclosed too late to CCADB within the tightest disclosure deadline required by the root store policies, and that this qualified as a compliance incident. Sectigo reported that the affected CCADB records contained outdated CP/CPS information for longer than permitted by the Chrome Root Program Policy, and that SSL.com did not cease issuance during the incident. Sectigo stated it created the bug on 2025-01-20 and deployed scripts to automatically monitor and alert on changes to the CP/CPS repository, audit seal website, and CCADB records. In the closure summary, Sectigo reported remediation including a standing monthly call with SSL.com and two methods of automated monitoring, and requested closure; Mozilla indicated it intended to close the bug on 14-February-2025. The bug is marked RESOLVED with resolution FIXED.

1. 2024-06-21 Sectigo issued sixteen Cross-Certified Subordinate CA Certificates to SSL.com.
2. 2024-09-13 SSL.com published CP/CPS v1.21 (Sectigo was not notified promptly).
3. 2024-12-13 SSL.com published CP/CPS v1.22 (Sectigo was not notified promptly).
4. 2025-01-17 Sectigo identified that CP/CPS disclosures to CCADB were late and qualified as a compliance incident.
5. 2025-01-21 Sectigo completed and deployed scripts to automatically monitor and alert on CP/CPS and related CCADB changes.
6. 2025-02-12 Sectigo posted an incident report closure summary and requested closure of the bug.

1. 2025-01-20 Sectigo — Opened an initial incident report stating that sixteen CCADB records contained outdated CP/CPS information because SSL.com did not notify Sectigo promptly, and said an incident report would follow by 2025-01-31.
2. 2025-01-29 Sectigo — Posted an incident report describing the impact (outdated CP/CPS in sixteen CCADB records beyond permitted timelines) and provided a detailed timeline.
3. 2025-02-05 Sectigo — Noted Sectigo would post an incident report closure summary by the following week unless questions were raised.
4. 2025-02-07 SSL.com — SSL.com said it failed to notify Sectigo directly on two occasions, updated its CP/CPS Change Management procedure, and scheduled regular coordination meetings as corrective action.
5. 2025-02-12 Sectigo — Provided an incident report closure summary with remediation steps (standing monthly call and automated monitoring) and requested closure of the bug.
6. 2025-02-12 Mozilla representative — Stated an intention to close the bug on Friday, 14-February-2025.