Sectigo: Late receipt and disclosure to CCADB of ETSI audit letters

Sectigo reported a late disclosure of ETSI audit letters for their QWAC Subordinate CAs, which violated Mozilla and Chrome Root Program Policies. The audit period was unexpectedly shortened to less than 365 days without notification, leading to a delay in submission to CCADB. Sectigo has since updated their internal practices to prevent future occurrences, including improved communication with auditors and a more thorough review process for audit letters.

1. 2025-01-30 Sectigo discovers shortened audit period while submitting ETSI audit letters.
2. 2025-02-12 Sectigo submits incident report detailing the late disclosure.
3. 2025-02-26 Incident report closure summary provided by Sectigo.