← Sectigo cases
Bugzilla #2077538
Ca Certificate Compliance
Incident
Self Reported Incident
Certificate Misissuance
Problem Reporting Failure
Sectigo incident report on DV TLS certificates issued for sanctioned entities
ASSIGNED
Sectigo
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Sectigo opened this bug to report an incident involving DV TLS certificates for domain names whose owners appear on UK or US sanctions lists. Sectigo says it received two Certificate Problem Reports, investigated the scope, added the affected domains to internal block lists, and planned revocation of the certificates in scope. The full incident report states that 112 certificates were affected and that all remaining valid certificates were revoked by 2026-10-06. Sectigo also says the certificates were issued through partners and that its CP/CPS language prohibits issuance to entities on certain denied or prohibited lists. The bug remains open with Sectigo asking for a next update date of 2026-11-05.
Chronology
- Sectigo published CPS language stating it does not issue certificates to entities on certain denied or prohibited lists.
- Sectigo received the first CPR about certificates issued to entities on US or UK sanction lists.
- Sectigo scheduled revocation of 92 certificates.
- Sectigo received a third CPR reporting another domain name and 16 certificates.
- Sectigo revoked all certificates from the last batch.
Thread Activity
- Sectigo — Sectigo filed a preliminary incident report saying it had received two CPRs and planned to revoke the certificates in scope.
- Duck representative — A commenter said Bugzilla is not the right venue for sanctions enforcement matters and pointed readers to relevant authorities.
- Sectigo — Sectigo posted the full incident report, including scope, timeline, revocation actions, and related policy references.
- Sectigo — Sectigo said it is monitoring the bug for questions or comments and requested a next update of 2026-11-05.
Participants
Sectigo
Duck representative
External References
Related Bugzilla IDs Mentioned
Similar Local Cases
Sectigo: Failure to block disallowed LDH labels in domain names
Sectigo: Incorrect JOI for federal credit unions
Sectigo: No revocation after CP/CPS language involving extendedKeyUsage found to be subject to multiple interpretations
Sectigo: Signing infrastructure migration disrupted issuance of 2 CRLs
Sectigo: Incorrect OCSP responses
Sectigo: Legacy Subordinate CA Certificate without digitalSignature KU signing OCSP responses
Sectigo: Incorrect jurisdictionStateOrProvinceName attribute value in Code Signing certificate
Sectigo: Subject field with unvalidated information included in certificates