Sectigo incident report: CPR was not responded to within the required timeframe

Sectigo reported that it failed to respond to a Certificate Problem Report within the required timeline under BR §4.9.5. The initial report said the CPR could not be found in Sectigo’s records and that the company was investigating the issue. The full incident report later stated that the CPR had been submitted through a mechanism Sectigo did not intend for CPRs, and that a support ticketing system outage prevented the original submission from reaching the support desk. Sectigo said it clarified its CPS language to remove the support ticket from CPR scope. The bug remains open in ASSIGNED status, and CCADB posted a final call for comments with a planned closure date of 2026-10-19.

1. 2026-09-15 A CPR was submitted to Sectigo through a support ticket form that Sectigo later said was not intended for CPRs.
2. 2026-09-16 Sectigo identified that it had not responded to the CPR within the required timeline and investigated the missing report.
3. 2026-09-24 Sectigo published a CPS update clarifying the intended mechanism for CPR submission.
4. 2026-10-12 Sectigo filed a closure summary stating remediation was complete and requesting closure.

1. 2026-09-18 Sectigo — Sectigo opened a preliminary incident report saying it had not responded to a CPR within the required timeline and would provide a full report by 2026-09-30.
2. 2026-09-30 Sectigo — Sectigo filed the full incident report, explaining the CPR was submitted via an unintended mechanism and that a ticketing outage prevented delivery to support.
3. 2026-10-05 Sectigo — Sectigo said it was monitoring the bug for questions or comments.
4. 2026-10-12 Sectigo — Sectigo posted a closure summary describing the root cause, remediation, and request for closure.
5. 2026-10-12 CCADB representative — CCADB issued a final call for comments and said the bug would be closed around 2026-10-19.