SSL.com: failure to respond to Certificate Problem Reports within 24 hours; final action item in progress
SSL.com reported that its Certificate Problem Report intake path stopped forwarding form submissions to its internal mailbox after an Amazon SES IP-based forwarding change. As a result, SSL.com missed the BR §4.9.5 requirement to provide preliminary responses within 24 hours for five legitimate CPRs, and the incident report says six emails from five reporters were missed in total. The report also says the intake failure delayed one certificate revocation, but this bug is about the procedural failure to respond to CPRs on time, not the underlying certificate issues. SSL.com identified the non-compliance period as 2026-07-21 through 2026-07-26 and said the intake problem was resolved on 2026-07-26. In the latest update, SSL.com said work on final Action Item #3 is in progress: implementing a test email inbox that follows the same intake path, receives regular submissions, and alerts if a submission fails to land. SSL.com asked for the next update to be set for 2026-09-18 and said it will post sooner if the action item is completed earlier.
- SSL.com’s CPR web form last successfully forwarded a report before the forwarding failure began.
- SSL.com missed the 24-hour preliminary response deadline for CPRs received through the broken intake path.
- SSL.com’s CPR intake forwarding issue was resolved.
- SSL.com’s final Action Item #3 is due to be completed.
- SSL.com — SSL.com filed a preliminary incident report saying it had received a third-party follow-up about an unanswered CPR and was investigating the root cause.
- SSL.com — SSL.com filed a full incident report explaining that SES IP-based forwarding changes caused missed CPR emails, delayed five CPR responses, and delayed one revocation.
- SSL.com — SSL.com said it continues to monitor the bug and work on the action items from its incident report, with another update promised by 2026-08-21.
- SSL.com — SSL.com said it continues to monitor the bug and work on its final action item, with another update promised by 2026-08-28.
- SSL.com — SSL.com said final Action Item #3 is in progress, is on track for its 2026-10-15 due date, and asked for the next update to be set for 2026-09-18.