Sectigo: Certificate issuance by non-compliant Extant S/MIME CA
Sectigo reported a self-discovered incident involving its non-compliant Extant S/MIME CAs. The company became aware that 6 of its Extant S/MIME CAs may have issued S/MIME certificates on and after September 15, 2024, and it investigated the scope and impact. Sectigo stated that 5 of the 6 non-compliant Extant S/MIME CAs were previously marked as disabled in its system, but a software bug allowed continued usage for new issuance; the remaining CA had not previously been identified as non-compliant and therefore was not disabled until recently. Sectigo reported that 996 certificates were issued since 2024-09-15, with 531 remaining valid (unexpired and unrevoked) when the incident was identified, and that issuance by the affected CAs was halted due to a software bugfix prior to identification. As remediation, Sectigo said it completed refactoring of its SubCA management to add technical constraints against S/MIME SubCA profile requirements and implemented a bugfix to prevent usage of unauthorized S/MIME SubCAs. Sectigo requested closure, stating that the disclosed action items were completed as described.
- Non-compliance period began for the Extant S/MIME CA certificates, per Sectigo’s incident timeline.
- Sectigo identified the incident after discovering that non-compliant Extant S/MIME CAs had issued S/MIME certificates on or after 2024-09-15.
- Sectigo’s incident timeline indicates the non-compliance ended.
- Sectigo provided a report closure summary and requested closure after remediation was completed.
- Sectigo — Opened a preliminary incident report stating Sectigo became aware that one or more non-compliant Extant S/MIME CAs may have issued S/MIME certificates on or after 2024-09-15 and that it was investigating scope and impact.
- Sectigo — Provided a full incident report with details including that 6 non-compliant Extant S/MIME CAs issued 996 certificates since 2024-09-15 and described the software bug and remediation timeline.
- Sectigo — Noted that Sectigo was monitoring the bug for questions or comments.
- Sectigo — Submitted a report closure summary stating remediation was completed (refactoring and a bugfix) and requested closure.
- CCADB representative — Issued a final call for comments and indicated the report would be closed approximately 2025-12-18 unless needinfo was provided.