Sectigo incident: signing infrastructure migration disrupted CRL issuance for two subordinate CAs
Sectigo reported that a signing infrastructure migration disrupted CRL issuance for two issuing CAs. The company said it noticed on 2026-10-03 that the CRLs had expired without new CRLs being signed, and it restored service within about two hours of becoming aware. Sectigo also said it received a Certificate Problem Report later that day about the same issue. In its report, Sectigo described the event as a delayed CRL issuance incident, but stated it did not consider it delayed revocation because the affected certificates did not include CRL Distribution Points and the referenced OCSP service was not affected. The report identifies the affected CRLs as those for ZeroSSL ECC DV SSL CA 2 and ZeroSSL RSA DV SSL CA 2. The bug remains assigned, and no resolution is recorded in the thread excerpt provided.
- Sectigo deployed new signing infrastructure intended to replace existing signer deployments and HSMs.
- Sectigo migrated 15 production subordinate CAs to the new signing infrastructure.
- Sectigo migrated 6 additional production subordinate CAs to the new signing infrastructure.
- CRLs for two issuing CAs expired without new CRLs being signed, and Sectigo later restored CRL issuance.
- Sectigo — Sectigo filed a preliminary incident report saying the CRL issuance disruption was self-reported and also reported by a third party.
- Sectigo — Sectigo filed the full incident report with the timeline, affected subordinate CAs, and related incident references.