Sectigo: Failure to reply to Certificate Problem Reports within 24 hours
Sectigo disclosed an incident in which a problem with its Certificate Problem Report (CPR) email queue caused it to fail to reply to several CPRs within the required 24 hours. The issue began after a change to the Case Origin logic in its Salesforce-based CRM, which broke the logic directing CPR emails into the correct queue. Sectigo reported that it became aware of the problem on October 13 and subsequently restored visibility into pending CPR emails, started processing the backlog, and opened an IT helpdesk ticket to address the CRM breakdown. The incident affected 68 CPRs referencing 150 certificates, and Sectigo stated that all CPRs were triaged and that there were 0 remaining valid certificates. In its remediation, Sectigo restored the Case Origin logic, added testing for CPR flows as part of CRM changes, and added automated SLA monitoring with alerting and escalation for the CPR queue. Sectigo requested closure after completing the disclosed action items, and CCADB issued a final call for comments before closure.
- A CRM Case Origin logic change disrupted routing of CPR emails into the correct queue.
- Sectigo identified that CPR email handling had failed to meet the 24-hour reply requirement.
- Sectigo restored visibility into pending CPR emails and processed the backlog.
- Sectigo reverted the CRM Case Origin logic change to restore functionality.
- Automated monitoring and alerting changes for CPRs were deployed to production.
- Sectigo posted a report closure summary and requested closure.
- Sectigo — Sectigo provided a preliminary incident report stating that a CPR email queue problem caused missed 24-hour replies and cited Baseline Requirements section 4.9.5.
- Sectigo — Sectigo submitted a full incident report with timeline, scope (68 CPRs, 150 certificates), and stated that all CPRs were triaged and there were 0 remaining valid certificates.
- Sectigo — Sectigo reported completion of a scheduled action item and requested a next update for 2025-11-30.
- Sectigo — Sectigo stated that automated monitoring and alerting changes for CPRs went into production and that it would post a report closure summary by the following week.
- Sectigo — Sectigo posted a report closure summary describing the root cause, remediation steps (restored logic, added testing, added automated SLA alerting/escalation), and requested closure.
- CCADB representative — CCADB issued a final call for comments and stated the bug would be closed on approximately 2025-12-10.