DigiCert legal threat to Sectigo comments and resulting transparency dispute
This case concerns DigiCert’s sending of a cease-and-desist letter to Sectigo over comments made in Bugzilla about DigiCert’s handling of a TRO connected to Bugzilla 1910805. The bug was opened by Sectigo’s Brian Holland, who said the letter was an attempt to stifle open discussion and that DigiCert had threatened legal action if the comments continued. DigiCert initially said it sent the letter to address what it viewed as misleading statements, then later acknowledged that sending the letter was a mistake and not in the best interest of transparency. DigiCert also stated that it would use Mozilla’s Community Participation Guidelines rather than external legal process for future forum-abuse concerns, and it described an internal ombudsperson process for raising concerns. The thread later included a full incident report and closure summary from DigiCert, which said the event did not involve certificates, but did involve legal action that could have had a dampening effect on public discussion. The current thread state shows DigiCert saying it has no additional comments and asking whether the matter can be considered resolved, while other participants continued to ask for more explanation and safeguards.
- DigiCert learned a TRO had been filed in connection with the revocation matter later discussed in Bugzilla 1910805.
- DigiCert’s law firm sent a cease-and-desist letter to Sectigo about Bugzilla comments concerning the TRO and DigiCert’s operations.
- Sectigo responded to the letter and DigiCert later said the matter was considered resolved by its legal team.
- Sectigo opened Bugzilla 1950144 to disclose and challenge the legal letter.
- DigiCert posted a full incident report and said the letter could have dampened public discussion.
- DigiCert said it had finalized an ombudsperson program with a four-person team.
- DigiCert posted a closure summary and action items for handling similar legal issues in the future.
- Sectigo — Brian Holland opened the bug and said DigiCert’s lawyers sent a letter demanding that Sectigo stop statements about DigiCert in Bugzilla.
- DigiCert — DigiCert said it sent the letter to defend the integrity of the forum and to address what it viewed as misleading statements.
- Mozilla representative — Mozilla said open discussion is important and that actions chilling participation are deeply damaging to the community.
- DigiCert — DigiCert said it had voluntarily disclosed the TRO, that the letter was sent because of competitor comments, and asked to close the issue because it saw no compliance violation.
- DigiCert — DigiCert acknowledged the letter was not in the best interest of transparency and said it regretted sending it.
- Google representative — Chrome Root Program said the discussion should continue in the bug and that intimidating participation is unacceptable.
- DigiCert — DigiCert posted a full incident report explaining the letter, its impact, and its planned remediation.
- DigiCert — DigiCert said it was setting up an independent ombudsperson contact process.
- DigiCert — DigiCert said the ombudsperson program was finalized and provided the contact address t**********y@digicert.com.
- DigiCert — DigiCert posted a closure summary describing the incident, root causes, and action items.
- Community commenter — Jeremy Rowley said he resigned in July 2024, later returned in a different role, and was not part of incident response.
- DigiCert — DigiCert said the ombudsperson process would be documented in its CPS and that it was evaluating adding an external representative.