Google Trust Services: incorrect SCT in certificate

RESOLVED FIXED Google Trust Services LLC

This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update. Always refer to the official Bugzilla thread as the authoritative source. If you spot an inaccuracy, let me know via the contact form.

AI Summary

Google Trust Services (GTS) discovered that a certificate it issued contained incorrect Signed Certificate Timestamps (SCTs) that did not match the corresponding precertificate. This issue was identified when a user reported the problem, prompting GTS to investigate. They confirmed that the SCTs were invalid and ceased issuance of SignedHTTPExchange (SXG) certificates. GTS has since revoked the affected certificates and implemented a fix to prevent future occurrences. A full report detailing the incident and corrective actions is expected to be published.

Model: gpt-4o-mini Generated: 2026-06-13 21:33 UTC Revised: 2026-06-16 18:47 UTC Confidence: 0.90 11 comments

Chronology

2023-02-09 GTS discovers incorrect SCTs in issued certificate.
2023-02-14 GTS revokes the problematic certificate.
2023-02-14 GTS revokes remaining affected certificates.
2023-02-14 GTS resumes issuance of SXG certificates after fixing the bug.

Thread Activity

2023-02-09 Mm representative — Reported incorrect SCTs in a certificate issued by GTS.
2023-02-09 Google representative — GTS is investigating the issue.
2023-02-10 Google representative — Confirmed SCTs are invalid and ceased issuance of SXG certificates.
2023-02-14 Google representative — Revocation of the problematic certificates has started.
2023-02-23 Google representative — GTS verified that the bug can be caught using Go's Data Race Detector.
2023-03-01 Google representative — GTS requests consideration to close the bug.

Participants

Community commenter

External References

Original Bugzilla Case

Similar Local Cases

#1979457 RESOLVED Self Reported Incident Opened 2025-07-25 · Closed 2025-10-22 · 84% similar

Google Trust Services: Missing authorization audit log entry for certificate issuance

AI Summary CA Owner

#1770510 RESOLVED Self Reported Incident Opened 2022-05-20 · Closed 2023-05-04 · 83% similar

Google Trust Services: Failure to provide preliminary report within 24h

AI Summary CA Owner

#1630040 RESOLVED Self Reported Incident Opened 2020-04-14 · Closed 2023-02-22 · 79% similar

Google Trust Services: OCSP serving issue 2020-04-09

AI Summary CA Owner

#2032511 RESOLVED Ca Security Vulnerability Self Reported Incident Opened 2026-04-16 · Closed 2026-05-29 · 79% similar

Google Trust Services: Short OCSP outage

AI Summary CA Owner

#1630079 RESOLVED Self Reported Incident Opened 2020-04-14 · Closed 2023-02-22 · 78% similar

Google Trust Services: Invalid OCSP responses

AI Summary CA Owner

#2017747 RESOLVED Self Reported Incident Opened 2026-02-18 · Closed 2026-04-30 · 71% similar

Google Trust Services: Outdated BR version in some validation records

AI Summary CA Owner

#1648472 RESOLVED Self Reported Incident Opened 2020-06-25 · Closed 2024-06-30 · 71% similar

Entrust: SHA-256 hash algorithm used with ECC P-384 key

AI Summary CA Owner

#1752670 RESOLVED Certificate Misissuance Self Reported Incident Opened 2022-01-29 · Closed 2024-05-09 · 68% similar

Let's Encrypt: TLS Using ALPN Allows Additional Identifiers in Challenge Certificate

AI Summary CA Owner