Sectigo self-reported incident tracking non-revocation after CPS language interpretation issue
Sectigo opened this bug as a self-reported incident after deciding not to revoke certificates connected to the CPS language issue discussed in bug 2069636. Sectigo said the CPS language had proven subject to more than one interpretation and stated that it did not believe the matter was a case of certificate misissuance. The bug is being used to track the remaining validity of the affected corpus and to provide a place for commentary while the incident report is maintained. Sectigo’s full incident report said it would not perform revocation in connection with this matter and that the bug would track active, expired, and revoked certificates. The thread has continued with periodic updates showing the counts of total, revoked, expired, and active certificates, most recently as of 2026-10-18. The bug remains assigned to Sectigo and no closure is recorded in the thread.
- Sectigo discussed CPS language it said had more than one interpretation and announced intent to open a CA incident issue.
- Sectigo opened the incident bug and stated that no revocation would occur in connection with the matter.
- Sectigo posted updated counts of active, revoked, and expired certificates in the affected corpus.
- Latest expiration date for any of the relevant leaf certificates, according to Sectigo's report.
- Sectigo — Sectigo filed a preliminary incident report, identified it as self-reported, and said a full incident report was being drafted.
- Sectigo — Sectigo filed the full incident report, said it did not intend to revoke certificates in connection with the matter, and provided the certificate counts and timeline.
- Sectigo — Sectigo said it would use a regular reporting format for the counts of active, revoked, and expired certificates and posted updated totals.
- Sectigo — Sectigo posted another update with revised counts for total, unexpired-but-revoked, expired, and active certificates.
- Sectigo — Sectigo posted the latest counts as of 2026-09-29 and again stated that no misissuance occurred.
- Sectigo — Sectigo posted updated certificate counts as of 2026-10-05 and repeated that no misissuance occurred.
- Sectigo — Sectigo posted updated certificate counts as of 2026-10-08 and repeated that no misissuance occurred.
- Sectigo — Sectigo posted updated certificate counts as of 2026-10-11 and repeated that no misissuance occurred.
- Sectigo — Sectigo posted updated certificate counts as of 2026-10-14 and repeated that no misissuance occurred.
- Sectigo — Sectigo posted updated certificate counts as of 2026-10-18 and repeated that no misissuance occurred.