2077538 - Sectigo: Certificates issued for sanctioned entities

Status: ASSIGNED

(CA Program :: CA Certificate Compliance, task)

Description

[Martijn Katerbarg]

Preliminary Incident Report

Summary

• Incident description:
  Sectigo received two Certificate Problem Reports reporting a number of DV TLS certificates for which the owner of the domain name appears on one or more UK or US sanction lists.

  We are currently investigating the incident and plan to revoke the certificates in scope of the report. Meanwhile, we are investigating the extent of sanctions imposed as to their nature and scope.

• Relevant policies:

  • Sectigo TLS Certificates Certificate Policy and Certification Practice Statement version 6.2.6 Section 4.1.1
  • Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates version 2.3.0 Section 9.15

• Source of incident disclosure: Third party reported

Comment 1

[Iakov, son of Isaac]

Hello Bugzilla community and researchers,

I would like to reiterate what was noted in Bug 2049237: Bugzilla is not the appropriate venue for discussing sanctions enforcement matters.

If you are looking to report potential sanctions violations or compliance concerns, please reach out directly to the relevant regulatory and law enforcement authorities:

United States:

• OFAC (Office of Foreign Assets Control):
  • Contact form: ofac.treasury.gov
  • Email: [e-mail] / [e-mail]
• FinCEN (Financial Crimes Enforcement Network):
  • Website / Contacts: fincen.gov
  • Note: Under the Anti-Money Laundering Whistleblower Program, informants (including non-US citizens) may be eligible for financial awards (10% to 30% of collected penalties) for reporting qualifying sanctions and AML violations.

United Kingdom:

• OFSI (Office of Financial Sanctions Implementation): gov.uk/ofsi / [e-mail]
• NCA (National Crime Agency): nationalcrimeagency.gov.uk
• SFO (Serious Fraud Office): sfo.gov.uk

(Similar to the precedent in the HARICA case, where reports submitted to the EETT were forwarded to the Hellenic Anti-Money Laundering Authority / Unit B – Financial Sanctions Unit).

---

Security & Anonymity reminder:
Given reports of harassment and intimidation originating from individuals associated with sanctioned entities (which is completely unacceptable), I strongly recommend using privacy-focused email aliases or secure providers (such as duck.com or proton.me) when communicating on sensitive matters.

Comment 2

[Martijn Katerbarg]

Attachment: Affected Certificates.csv

Comment 3

[Martijn Katerbarg]

Full Incident Report

Summary

• CA Owner CCADB unique ID: A000016

• Incident description:
  Sectigo received Certificate Problem Reports reporting a number of DV TLS certificates for which the owner of the domain name appears on one or more UK or US sanction lists.

  Sectigo does maintain internal block lists, incorporating sanctioned entities and a minor number of domains. In addition, we perform blocklist checks during the validation of OV and EV organization details.

  Historically, domain names have not been incorporated by default, barring certain exceptions, as most, if not all sanctions are imposed on organizations and individuals.

  When it comes to DV certificates, the existence of a certificate for a domain name referenced on a sanction list does not indicate that Sectigo has done business with said entity. For the certificates impacted by this bug, all certificates were placed through partners of Sectigo.

• Timeline summary:

  • Non-compliance start date: The language has been part of our CPS as of CPS 2023-05-17.
  • Non-compliance identified date: 2026-09-30 – 02:23
  • Non-compliance end date: 2026-10-06 – 18:09

• Relevant policies:

  • Sectigo TLS Certificates Certificate Policy and Certification Practice Statement Section 4.1.1

• Source of incident disclosure: Third party reported

Impact

• Total number of certificates: 112
• Total number of "remaining valid" certificates: 0
• Affected certificate types: TLS DV
• Incident heuristic: The full corpus of affected certificates are disclosed in the Appendix.
• Was issuance stopped in response to this incident, and why or why not?: Issuance for the affected domains was halted by adding these to our block list.
• Analysis: N/A

Timeline

All times are in UTC.

2023-05-17:

• We publish Sectigo WebPKI CPS version 5.3.7, which includes wording preventing issuance to sanctioned entities.

2026-09-30:

• 01:31 We receive a CPR indicating the issuance of 79 certificates to entities on US or UK sanction lists.
• 02:23 We review the CPR internally.
• 09:00 We create a DBA ticket to add the mentioned domain names to our block list and request a report of all certificates issued for these domains.
• 12:56 A second CPR from the same reporter is received, highlighting an additional domain name and certificate.
• 14:03 We add the addition domain name to the scope of the DBA ticket, which remains pending.
• 14:26 We block the domain names in question.
• 18:41 Our initial assessment determines 6 out of the 7 domain names are indeed listed as either an identifier or reference for several legal entities on UK or US sanction lists. For the 7th domain, there are indications the domain name is owned by a legal entity for which a person in a leading role is listed on a sanction list. From our perspective, we do not believe this passes the bar of considering issuance a violation of our CPS. This belief is strengthened by the fact that these are DV certificates issued through a partner.

2026-10-01:

• 12:31 The database report is complete.
• 23:11 We schedule the revocation of 92 certificates.

2026-10-03:

• 10:32 A third CPR report is received from the same reporter, highlighting another domain name and 16 certificates.
• 12:31 We create an additional DBA ticket to add the mentioned domain name of the third CPR to our block list and request a report of all certificates issued for this domain.
• 20:09 All certificates identified by the first two CPRs and our internal investigation are revoked.

2026-10-05:

• 14:10 We block the domain name listed in the third CPR.
• 14:46 The database report is complete.

2026-10-06:

• 18:09 All certificates from the last batch are revoked.

Related Incidents

No related incidents were found.

We would however like to highlight bug 2049237, which was originally classed as a refusal to revoke and refusal to halt issuance. As far as we can determine, HARICA’s CPS did not explicitly forbid such issuance, making this case different from ours.

Sectigo’s CP/CPS explicitly states that:

Sectigo does not issue Certificates to entities on a government denied list, list of prohibited persons, or other list that prohibits doing business with maintained by the US or UK

Accordingly, even if specific sanctions do not prohibit issuance, the language of our CP/CPS blocks issuance when a party appears on a described list.

Because this incident involves a misalignment between our issuance practices and language in our CP/CPS, we believe this to be an appropriate forum. without regard to the applicability of any specific sanction.

Root Cause Analysis

Contributing Factor #1: No automated sanction list integration for domain names

• Description:
  Up until now, barring certain exceptions, our sanction/block list processing has mostly been focused on the vetting of organization details and applicant representatives. As mentioned above, in general, legal entities are sanctioned, not domain names per se. This focus, in part, has been focused on that section of certificate validation due to the requirements in the EV Guidelines.

  As such, for these blocklist Sectigo mainly monitors and manages legal entity blocklists, without considering the domain names in question.

• Timeline: Such automated, domain-based block lists have not existed in the past.

• Detection: This incident

• Interaction with other factors: Is extended by Contributing Factor 2

Contributing Factor #2: Domain Name blocking not previously considered

• Description:
  Similar to, and as an extension for Contributing Factor 2, our sanction/block list processing has mostly been focused on the vetting of organization details and applicant representatives.
  In addition to that, Sectigo has not previously considered a domain name referenced on a sanction for a legal entity, to be considered inclusive of the sanctions.

• Timeline: This has always been the general case.

• Detection: This incident

• Interaction with other factors: Extends Contributing Factor 1

Contributing Factor #3: CPS sanction language too widely scoped

• Description:
  The CPS language specifically forbids issuance to curtained sanctioned entities, period. However, the existence of an entity on a sanctions list does not necessarily bar a CA (subject to language in their CPS - as is the case here) from issuing a certificate to the entity. As an example, many sanctions currently in place are specifically bound to financial assets, transactions, or export of certain materials, and thus may allow a CA to continue issuing certificates to such a domain name.

• Timeline: 2023-05-17

• Detection: This incident.

• Interaction with other factors: N/A

Lessons Learned

• What went well:

• There was a limited set of affected domain names.

• We were quickly able to block the reported domain names.

• What didn’t go well:

• Our CPS blocklist language was too widely scoped.

• Where we got lucky: N/A.

• Additional:

  We acknowledge comment #1 in this bug. The reason we do believe this constitutes an incident, and thus requires a Bugzilla bug, is that our CPS specifically states that

Sectigo does not issue Certificates to entities on a government denied list, list of prohibited persons, or other list that prohibits doing business with maintained by the US or UK or that is located in a country with which the laws of the US or UK prohibit doing business.

This comment does not make any provisions on which sanctions are or are not in scope. A large subsection of sanctioned entries is specifically related to financial assets, or otherwise sanctions which would allow a CA to continue certificate issuance, our CPS does not currently allow this.

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Add automated integration with applicable and automatable sanction lists into our existing block list functionality.	Prevent	Contributing Factor #1	Incorporating (semi) automated blocklist functionality, should prevent such behavior in the future.	2026-11-29	Ongoing
Incorporate domain names referenced in sanction lists within our scope of sanctioned entities.	Prevent	Contributing Factor #2	Including referenced domain names should prevent future issuance for sanctioned domain names.	2026-11-29	Ongoing
Update CPS blocklist language.	Prevent	Contributing Factor #3	The existence of an entity on a sanction list does not by default mean a CA is by law prevented of issuing a certificate for a domain name. We intend to define our internal policy around this from a legal perspective and update the CPS accordingly.	2026-11-02	Ongoing

Appendix

The affected certificates are listed in attachment #9657883 [details].

Comment 4

[Tim Callan]

We are monitoring this bug for questions or comments. We request a Next Update of 2026-11-05.