← Sectigo cases
Bugzilla #2080798
Ca Certificate Compliance
Incident
Self Reported Incident
Security Incident
Sectigo preliminary incident report: subordinate CA certificate used to sign OCSP responses without digitalSignature key usage
ASSIGNED
Sectigo
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Sectigo opened this bug as a preliminary incident report about a subordinate CA certificate issue. Sectigo said that for at least one subordinate CA certificate, OCSP responses were being signed by the CA private key even though the subordinate CA certificate did not assert the digitalSignature key usage. The report says Sectigo is currently investigating the incident. The comment identifies the source of the incident disclosure as a third-party report, but the bug itself was opened by Sectigo. No remediation or closure is recorded in the thread provided.
Chronology
- Sectigo reported that at least one subordinate CA certificate was used to sign OCSP responses without asserting digitalSignature key usage.
Thread Activity
- Sectigo — Sectigo filed a preliminary incident report stating it was investigating the OCSP-signing/key-usage issue and noted the disclosure source was a third-party report.
Participants
Sectigo
External References
Similar Local Cases
Sectigo: Signing infrastructure migration disrupted issuance of 2 CRLs
Sectigo: Incorrect OCSP responses
Sectigo: Certificates issued for sanctioned entities
Sectigo: Incorrect JOI for federal credit unions
Sectigo: Failure to block disallowed LDH labels in domain names
Sectigo: Non-existent hostname in CDP and AIA URLs
Sectigo: No revocation after CP/CPS language involving extendedKeyUsage found to be subject to multiple interpretations
Sectigo: CPR response issues