Google Trust Services: Inconsistent MPCAA secondary perspective logging

Google Trust Services (GTS) self-disclosed an incident involving incomplete logging of Multi-Perspective Certificate Authority Authorization (MPCAA) checks. The issue was identified through GTS's automated audit software following a validation service update. Approximately 1.03% of remote perspective MPCAA check results did not complete due to errors, leading to a temporary halt in certificate issuance to expedite mitigation efforts. GTS implemented fixes and committed to stricter enforcement of MPCAA requirements, ensuring compliance with the CA/Browser Forum's Baseline Requirements. The incident was resolved, and issuance resumed after the necessary corrections were made.

1. 2025-03-15 Non-compliance began as GTS failed to complete remote perspective MPCAA checks.
2. 2025-04-10 GTS identified the non-compliance and declared an incident.
3. 2025-04-11 Issuance was halted to implement fixes, and compliance was restored.

1. 2025-04-11 Google representative — GTS filed a preliminary incident report detailing the logging issue and mitigation steps.
2. 2025-05-15 Google representative — GTS submitted a full incident report summarizing the root causes and remediation actions.
3. 2025-06-02 Google representative — GTS requested closure of the bug after addressing all questions and concerns.