DigiCert: Delayed response to a Certificate Problem Report due to email filtering and mailbox routing
This case concerns DigiCert’s failure to respond within 24 hours to a Certificate Problem Report sent to its published problem-reporting address. DigiCert said the CPRs were routed by an interaction between Microsoft 365 spam filtering and DigiCert’s email security platform into an unmonitored Junk folder instead of the monitored Revoke Inbox. Because the automated acknowledgment and review workflow only monitored the Inbox, the required response did not occur on time. DigiCert stated that no certificates were misissued and no revocations resulted from this incident; the underlying certificate issue is tracked separately in Bug 2055539. DigiCert reported that it corrected the mail-routing behavior on 2026-07-15, completed daily Junk-folder review on 2026-07-21, and later requested closure of the incident report. CCADB posted a final call for comments saying the report would be closed around 2026-08-17, and the bug is shown as RESOLVED/FIXED in the provided bug data.
- A CPR was sent to DigiCert’s published problem-reporting address and was routed away from the monitored mailbox.
- The 24-hour CPR response deadline passed without a response.
- DigiCert implemented a mail-routing rule so acceptable Mailsec ratings are delivered to the Inbox.
- DigiCert completed daily review of the Junk/spam folder and related digest handling.
- DigiCert — DigiCert said problem-report emails related to Bug 2055539 were not received, delaying logging and response, and cited BR v2.2.8 Section 4.9.3.
- DigiCert — DigiCert posted a preliminary incident report update to add a missing header and repeated the same incident description.
- DigiCert — DigiCert filed the full incident report explaining the spam-filter routing failure, the missed 24-hour CPR response, and the remediation that made Mailsec spam ratings definitive.
- DigiCert — DigiCert said it was continuing to work on the final action item and would post more details soon.
- DigiCert — DigiCert said action item #3 was complete and that it was investigating an additional web-based reporting mechanism outside the scope of this bug.
- DigiCert — DigiCert requested closure of the incident report after stating that all action items were complete.
- CCADB representative — CCADB issued a final call for comments and said the incident report would be closed around 2026-08-17.