SSL.com: failure to respond to Certificate Problem Reports within 24 hours; final call issued before closure
This case concerns SSL.com’s failure to meet the Baseline Requirements obligation to provide a preliminary response within 24 hours after receiving a Certificate Problem Report. SSL.com reported that its CPR web form at ssl.com/revoke stopped forwarding submissions to its internal mailbox after Amazon SES IP changes caused delivery failures. As a result, SSL.com missed the 24-hour preliminary response deadline for five reporters, and the intake failure also delayed revocation for two of the reports. SSL.com later restored delivery, moved the form to a dedicated IP address, and implemented a test inbox on the same intake path that alerts if a submission fails to land. On 2026-10-23, SSL.com filed a Report Closure Summary stating that all missed reports were answered, the required revocations were completed, and all action items were finished. The latest thread activity is a final call for comments or questions, with the bug expected to be closed around 2026-11-02 if there are no further comments.
- SSL.com’s CPR form last successfully forwarded a report before the intake failure began.
- SSL.com missed the 24-hour preliminary response deadline for CPRs received through the broken intake path.
- SSL.com restored delivery of CPR submissions to its internal mailbox.
- SSL.com moved the CPR form to a dedicated IP address.
- SSL.com’s test inbox on the same intake path began receiving regular submissions and alerting on failures.
- SSL.com filed a Report Closure Summary stating that all missed reports were answered and all required revocations were completed.
- SSL.com — SSL.com filed a preliminary incident report saying it had received a third-party follow-up about an unanswered CPR and was investigating the root cause.
- SSL.com — SSL.com filed a full incident report explaining that SES IP-based forwarding changes caused missed CPR emails and delayed five CPR responses.
- SSL.com — SSL.com said it was continuing to monitor the bug and work on the action items from its incident report.
- SSL.com — SSL.com said it was continuing to work on its final action item and would provide another update by 2026-08-28.
- SSL.com — SSL.com said final Action Item #3 was in progress and on track for its 2026-10-15 due date.
- SSL.com — SSL.com said final Action Item #3 was still in progress and asked for the next update date to be set to 2026-10-15.
- SSL.com — SSL.com said Action Item #3 was completed and that all action items for the incident had now been completed.
- SSL.com — SSL.com filed a Report Closure Summary stating that the intake issue was fixed, all missed reports were answered, required revocations were completed, and all action items were done.
- CCADB representative — CCADB issued a final call for comments or questions and said the incident report would be closed around 2026-11-02.