TORONTO, Canada, November 9, 2026 -- DigiCert has closed the file on its business-system incident, and the full incident report now published in Mozilla's Bugzilla tracker (Bug 2084460) reads as a cautionary tale about what happens when an internal system quietly becomes externally reachable.

The report, filed by DigiCert itself, describes an internal business system used to archive information customers provide to validate their identity. On February 4, 2025, the system was moved from a VPN-restricted network segment to a different availability zone during an infrastructure migration. That move inadvertently made the system externally accessible, and a self-registration feature intended for other uses became available to it. Accounts registered through that endpoint were not subject to the multi-factor authentication DigiCert otherwise requires, and although they were read-only by default, they could read archived data.

The unauthorized access ran from June 27 to July 2, 2026. DigiCert released an authorization fix on July 2, first suspected that archived data may have been accessed on October 12, confirmed it on October 19, and filed its preliminary incident report on October 20. The data involved was mostly business contact information: names, business email addresses, phone numbers, and business addresses. A small minority of accounts also held a customer-provided identity document, such as a driver's license, passport, or utility bill.

Crucially, no certificates were affected. DigiCert's CA services, CertCentral, and DigiCert ONE were untouched, customer login credentials and DigiCert-issued certificates remain secure, valid, and fully trusted, and the access could not write records, act as a validation approver, or issue certificates. Log review found no validation, issuance, or revocation activity tied to the account. Follow-up comments on the bug confirm the final two remediation actions are now complete: an internal audit that no business-system origin server remains externally accessible, and automated alerting for unexpected account creation.

"The certificates were never the story here," said Sarah Reid, Securetron. "The story is that an internal system changed its network position without a security review, and the monitoring that should have caught it had not been reassessed after the move. DigiCert's own root-cause analysis says the migration was treated as an infrastructure change rather than a security change. That is exactly the kind of drift that hides in every enterprise PKI estate, and it is why knowing every certificate, every trust store, and every system that touches identity data matters more than any single vendor's incident."

Securetron's PKI Trust Manager gives organizations that visibility. It continuously discovers certificates, expiring assets, and vulnerabilities across the enterprise, with no blind spots and no spreadsheets, and automates issuance, renewal, and monitoring for the entire certificate lifecycle. A built-in RFC 8555 ACME server with EAB, plus SCEP and EST, lets certbot, acme.sh, win-acme, and network devices enrol automatically. A single pane of glass covers ADCS, MSCA, Let's Encrypt, DigiCert, and ACME, with full audit trails for every action and expiry alerting with configurable lead times.

"When a deadline lands or an incident breaks, the teams that cope are the ones that already know what they hold," Reid added. "Inventory comes first. You cannot secure a certificate estate you cannot see, and you cannot answer a regulator, an auditor, or a customer about exposure you never inventoried."

PKI Trust Manager's Community Edition is free for up to 500 certificates, available on-premises or as a service through PKI Trust Cloud. Its Boltron-AI module discovers applications and services, profiles their configurations, and generates onboarding runbooks that bring each application under automated management.

About Securetron

Securetron builds PKI Trust Manager, an enterprise certificate lifecycle management platform that automates discovery, issuance, renewal, and monitoring across the full certificate estate, and AI-FW, a self-hosted AI firewall and governance gateway for AI agents and LLM backends. Learn more at https://securetron.net.

Press Contact

Sarah Reid, Securetron
1 Yonge St, Toronto, ON M5E 1E6, Canada
+1 (438) 927-8036
[email protected]
https://securetron.net