Sectigo third-party reported ambiguous CP/CPS EKU language; remediation action items continue
Sectigo opened this bug after receiving a third-party Certificate Problem Report about ambiguous language in Section 7.1.2.3 of its TLS CP/CPS. Sectigo says the sentence about serverAuthentication certificates containing both id-kp-serverAuth and id-kp-clientAuth could be read in more than one way, and that community feedback showed the wording was susceptible to multiple interpretations. Sectigo also says its issuance matched one valid interpretation of the text and that it has updated the CPS language. The thread shows ongoing disagreement from commenters, who continue to argue that the published CPS should be read against the certificates actually issued and that the matter should be treated as misissuance. Sectigo reported that action item 3, applying findings from the CPS review, was completed on 2026-10-09, while the remaining CPS linter/generator and related preventive items are still ongoing. On 2026-10-20, Sectigo requested a next update for 2026-11-05 and said it will continue to monitor the bug for questions and comments.
- Sectigo received a Certificate Problem Report about Section 7.1.2.3 of its TLS CP/CPS.
- Sectigo identified the period it described as the non-compliance window for the CPS language issue.
- Sectigo opened this bug to document the issue and prepare a Full Incident Report.
- Sectigo posted a Full Incident Report describing the CP/CPS ambiguity and its impact figures.
- Sectigo reported completion of the action item to apply findings from the CPS review.
- Sectigo requested a next update and said it would continue monitoring the bug.
- Sectigo — Sectigo filed a preliminary incident report saying it had received a CPR about the CPS language and was preparing a Full Incident Report.
- Sectigo — Sectigo posted a Full Incident Report saying it did not believe non-compliance occurred and that the CPS language had been removed.
- Community commenter — The commenter argued that the issue was misissuance and that revocations were still due.
- Sectigo — Sectigo said the sentence was ambiguous, agreed the ambiguity should be treated as an incident, and said the certificates were issued in accordance with its CPS.
- Community commenter — The commenter said Sectigo had received two CPRs, still maintained that no misissuance occurred, and had offered no revocation plan.
- Sectigo — Sectigo said it agreed the language was ambiguous, had updated its CP/CPS, and would continue reporting action-item progress.
- Sectigo — Sectigo said it completed the "Full CPS review with fresh eyes" action item and listed the remaining action items.
- Sectigo — Sectigo said action item 3, applying findings from the CPS review, was complete and updated the action-item status table.
- Sectigo — Sectigo requested a next update for 2026-11-05 and said it would continue to monitor the bug.