DigiCert incident report on outdated CP/CPS data in CCADB for 13 roots
DigiCert opened this incident report after a Sectigo employee notified it that CCADB was showing outdated CP/CPS information for 13 DigiCert roots. DigiCert said the problem involved an outdated CP/CPS entry appearing in CCADB and later explained that the issue was tied to an ALV error, a missed case notification, and failure to mark older documents as superseded. DigiCert updated its SOPs to require two people to review a case, added checks to its automated CCADB monitoring, and said it submitted an enhancement request for notifications to go to all CCADB contacts. The discussion also covered whether CP/CPS v7.04 had been disclosed in time and whether the older documents should have been superseded; DigiCert ultimately revised its root-cause summary and asked for closure. The bug was resolved as FIXED and the thread ended with closure requests after the incident report summary was posted.
- DigiCert published Public Trust CP/CPS v7.04.
- DigiCert created CCADB case 00002121 to update audits and CP/CPS.
- Sectigo reported that CCADB showed outdated CP/CPS information for 13 DigiCert roots.
- CCADB case 00002192 was approved for CP/CPS v7.04.
- DigiCert updated its SOP to mark outdated documents as superseded and require dual review.
- DigiCert — DigiCert opened the bug with a preliminary incident report saying 13 root records showed an outdated CP/CPS entry in CCADB.
- Google representative — Mozilla asked DigiCert to clarify the impacted roots, the CCADB links involved, and the ALV-related timeline.
- DigiCert — DigiCert said an employee did not run ALV or act on the case notification, and that the SOP needed updates for superseding documents.
- Mozilla representative — Mozilla said the delayed disclosure was not promptly updated in CCADB and asked DigiCert to revise its root-cause analysis.
- DigiCert — DigiCert posted a closure summary with incident description, root causes, remediation, and a request to close the bug.
- Sectigo — Sectigo attached the CPR that led to the incident bug and reiterated concerns about the delayed disclosure.
- DigiCert — DigiCert said it had no additional comments and asked for the bug to be closed.