Sectigo: Inaccuracy of CCADB-Disclosed URL for eIDAS CP/CPS
Sectigo reported a CCADB disclosure incident involving the direct URL for its eIDAS CP/CPS. The issue was triggered by a November 20, 2025 CMS migration/deployment where a data inaccuracy in the new CMS database inadvertently changed the specific CP/CPS URL disclosed in CCADB, without Sectigo becoming aware. Sectigo stated that the CP/CPS document itself remained publicly accessible via website navigation, but the CCADB-disclosed URL returned 404 after the deployment. The incident was identified after a third party reported an incorrect CP/CPS URL disclosed in CCADB for Sectigo’s 8 QWAC subordinate CAs; Sectigo confirmed the URLs were valid at time of disclosure and then updated the affected CCADB records. As remediation, Sectigo developed and deployed a “CCADB URL monitoring” application, and made the source code and a containerized package available for other CAs and community members via GitHub. The bug is marked RESOLVED with resolution FIXED, and Sectigo requested closure after stating the action items were completed.
- Sectigo deployed a new CMS/CRM into production, inadvertently changing the CP/CPS URL served for the CCADB-disclosed link.
- The CCADB-disclosed CP/CPS URL became invalid (start of the non-compliance period).
- Sectigo identified the non-compliance after a third party reported an incorrect CP/CPS URL in CCADB and confirmed the URLs returned 404.
- Sectigo updated the affected CCADB records to correct the CP/CPS URL.
- Sectigo completed remediation by deploying a CCADB URL monitoring application and requested bug closure.
- Community commenter — Martijn Katerbarg submitted a preliminary incident report describing the CMS migration/deployment that changed the CCADB-disclosed eIDAS CP/CPS URL without Sectigo noticing.
- Community commenter — Martijn Katerbarg posted a full incident report with a timeline, stated the incident was third-party reported, and described investigation and correction of CCADB records.
- Community commenter — Martijn Katerbarg requested a next update date of 2026-02-28 while monitoring the bug.
- Community commenter — Martijn Katerbarg reported remediation completion, including development/deployment of a CCADB URL monitoring application and publication of the code at GitHub, and requested closure.
- CCADB representative — i**********g@ccadb.org issued a final call for comments and stated the bug would be closed around 2026-03-04 if no further comments were received.