SSL.com’s 6 November 2026 report identifies 13 misissued certificates: four EV TLS and nine EV code-signing. The issuer reports all revoked by 17:17 UTC. Errors affected stored jurisdiction information.
SSL.com reports a pre-issuance check deployed on 3 November and record corrections completed on 6 November. Further agency-record and evidence-reuse controls remain ongoing, due 16 December. This is the issuer’s compliance report; we have not independently audited its systems.
Begin with an exact inventory match
For a certificate owner, the useful question is whether a specific item in your inventory appears in the report’s affected-certificate appendix. Compare the issuer and serial number, then identify its deployment owner. Do not assume that every certificate from the same provider needs replacement, or treat a matching organization name as an exact match.
If you find a match, ask the provider which replacement belongs to that order. Check the certificate actually served by the relevant endpoint or selected by the signing workflow. A new file in a portal is only one part of the deployment check.
Review the record behind the next order
Our suggested follow-up is a short evidence checklist:
- Record the source: note the registration authority and the organization record used for the order. Ask the certificate provider to resolve discrepancies instead of guessing the appropriate jurisdiction from a mailing address.
- Check reuse: before the next renewal or reissue, ask which stored details will be reused and how a correction is applied.
- Separate milestones: track replacement deployment and any promised preventive controls as different tasks. Give each an owner and a verification date.
- Preserve useful evidence: keep public certificate identifiers and the provider’s case reference in the change record. Do not put private keys into a support ticket.
These are proposed operational checks, not results from testing affected deployments. Decide any further response from the exact certificate, service and vendor guidance rather than from the incident headline alone.