Sectigo CPR response and incident report on countryName values in TLS certificates

Sectigo opened this bug after receiving a Certificate Problem Report on 2026-09-05 that was sent to 15 CAs and discussed the interpretation of the TLS Baseline Requirements definition of “Country.” Sectigo said it had long treated the subject:countryName in leaf TLS certificates as the country for the territory involved, with Hong Kong as the only exception. In response to the report, Sectigo investigated which country codes it had issued, confirmed that only “HK” was in scope, and temporarily paused issuance for that country code. Sectigo later filed a full incident report stating it believed the BR language was ambiguous and that the issue should be addressed by the CA/Browser Forum. The report says all disclosed action items were completed and requests closure of the bug as INVALID. The bug was still in final comment period, with CCADB noting a final call for comments before closure.

1. 2026-09-05 Sectigo received a Certificate Problem Report about country code usage in TLS certificates and paused issuance for HK after investigating.
2. 2026-09-16 Sectigo filed a full incident report saying the BR language was ambiguous and that only HK was affected.
3. 2026-09-23 Sectigo said its outstanding action item was complete and requested the bug be closed INVALID.

1. 2026-09-08 Sectigo — Sectigo posted a preliminary incident report describing the CPR, its countryName practice, and that it would provide a full report later.
2. 2026-09-16 Sectigo — Sectigo posted the full incident report, described the impact and timeline, and said it had temporarily halted issuance for HK.
3. 2026-09-23 Sectigo — Sectigo said all action items were complete and asked for the bug to be closed INVALID.
4. 2026-09-23 CCADB representative — CCADB issued a final call for comments and said the bug would be closed around 2026-09-30 if there were no further questions.