Actalis: pre-certificates with “certificateHold” as the revocation reason

RESOLVED FIXED Actalis

This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update. Always refer to the official Bugzilla thread as the authoritative source. If you spot an inaccuracy, let me know via the contact form.

AI Summary

Actalis reported an incident involving eight pre-certificates that were revoked with the reason 'certificateHold'. The CA discovered that a bug in the EJBCA software caused these pre-certificates to be revoked automatically when they did not result in issued certificates. Actalis has since resolved the bug and updated their EJBCA software. They provided a detailed incident report and outlined corrective measures, including automation to verify compliance of their CRLs and OCSP responses. The case has been marked as resolved.

Model: gpt-4o-mini Generated: 2026-06-13 21:27 UTC Revised: 2026-06-16 18:06 UTC Confidence: 0.85 14 comments

Chronology

2023-03-23 Actalis received a report about the revocation of eight pre-certificates.
2023-03-29 Actalis deployed an update to the EJBCA software to fix the bug.
2023-04-11 Actalis outlined corrective measures to prevent future incidents.

Thread Activity

2023-03-24 Staff representative — Actalis began investigating the reported issue regarding the revoked pre-certificates.
2023-03-31 Staff representative — Actalis provided a full incident report detailing the timeline and actions taken.
2023-06-23 Staff representative — Actalis confirmed that all corrective measures had been implemented.

Participants

Staff representative Community commenter HARICA Mozilla representative

External References

Original Bugzilla Case

Similar Local Cases

#1883731 RESOLVED Self Reported Incident Opened 2024-03-05 · Closed 2024-06-28 · 88% similar

Actalis: Certificates issued with invalid RDN order

AI Summary CA Owner

#1973238 RESOLVED Self Reported Incident Policy Document Issue Opened 2025-06-20 · Closed 2025-09-24 · 88% similar

Actalis: incorrect CP/S Last Update date in CCADB

AI Summary CA Owner

#2012157 RESOLVED Self Reported Incident Revocation Issue Security Incident Opened 2026-01-23 · Closed 2026-03-08 · 88% similar

Actalis: Issuance of certificate using keys previously reported as compromised

AI Summary CA Owner

#1716123 RESOLVED Ca Certificate Compliance Certificate Misissuance Self Reported Incident Opened 2021-06-12 · Closed 2024-05-25 · 87% similar

e-commerce monitoring GmbH: CN domain not in SAN

AI Summary CA Owner

#1714968 RESOLVED Ca Certificate Compliance Self Reported Incident Opened 2021-06-07 · Closed 2023-02-22 · 86% similar

GlobalSign: Incorrect RegNumber-Org Type combination

AI Summary CA Owner

#1390974 RESOLVED Certificate Misissuance Self Reported Incident Opened 2017-08-16 · Closed 2023-02-22 · 86% similar

Actalis: Non-BR-Compliant Certificate Issuance

AI Summary CA Owner

#1860750 RESOLVED Ca Certificate Compliance Self Reported Incident Opened 2023-10-24 · Closed 2023-11-08 · 84% similar

SwissSign: EV code in JurisdiktionStateOrProvinceName

AI Summary CA Owner

#1563579 RESOLVED Ca Certificate Compliance Self Reported Incident Opened 2019-07-04 · Closed 2023-02-22 · 84% similar

Sectigo: Failure to provide timely incident reports

AI Summary CA Owner