SSL.com incident report: MPIC was not performed for some DCV paths, affecting 2,700 TLS certificates
SSL.com opened this case to disclose an incident found during its annual WebTrust audit. The audit identified that MPIC corroboration evidence was missing for DCV performed on 4 sampled TLS certificates, and SSL.com later determined the issue affected 2,700 unexpired, unrevoked TLS certificates. SSL.com said an alternate DCV path in its RA platform had not been attached to the MPIC implementation, so MPIC checks were bypassed for that path. The company reported that it invoked its Mass Revocation Plan and revoked or expired all 2,700 affected certificates in less than 24 hours after discovering the incident. SSL.com also said it stopped new validation TLS issuance from the RA platform and has been working through remaining action items, with periodic updates requested and provided in the thread.
- TLS Baseline Requirements MPIC requirements became mandatory, making DCV completed through the secondary path non-conforming.
- SSL.com’s auditors followed up on MPIC evidence for certificate samples and the investigation began.
- SSL.com completed mass revocation for all unrevoked, unexpired affected certificates.
- SSL.com posted the full incident report and attached the incident annex.
- SSL.com — SSL.com said the incident was discovered during its annual WebTrust audit, that 2,700 TLS certificates were affected, and that it would post a full incident report by 2026-09-25.
- SSL.com — SSL.com posted the full incident report and attached the MPIC incident annex.
- SSL.com — SSL.com said remaining action items were in progress and on track for their due dates.
- SSL.com — SSL.com said the action items were still on track and requested the next update be set for 2026-10-30.
- SSL.com — SSL.com said work on the remaining action items continued and again requested the next update be set for 2026-10-30.