Apple: CRLs for dormant CAs will not be populated in CCADB

Apple Inc. reported that it would not populate the CCADB with CRLs for eight dormant CA certificates capable of issuing TLS certificates, as they have never produced a CRL nor signed a certificate. This decision was made in light of the Mozilla Root Store Policy requirements effective October 1, 2022. The incident raised discussions among involved parties, including Sectigo and DigiCert, regarding compliance with the policy and the implications for non-issuing CAs. Ultimately, the case was resolved with the understanding that the policy would be updated to clarify requirements for dormant CAs.

1. 2018-12-12 DigiCert issued six CAs to Apple.
2. 2019-06-19 Sectigo issued two CAs to Apple.
3. 2022-06-01 Mozilla Root Store Policy version 2.8 effective.
4. 2022-09-21 Mozilla noted intent to modify policy.
5. 2022-09-27 Apple concluded discussions with root vendors.
6. 2022-09-28 Apple Root Program Policy updated.
7. 2022-10-01 Incident report acknowledged by Sectigo.