FNMT: Delayed disclosure of updated Root Certificate policy documents in the CCADB
FNMT (Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT)) reported that updated Root Certificate policy documents were not properly disclosed in the CCADB within the required timeframe. FNMT said it became aware of the issue on May 19, after updated policy documents had been published on the FNMT-RCM website within the last 365 days but were not correctly reflected in CCADB. The incident affected the policy documents for the CA roots AC RAIZ FNMT-RCM and AC RAIZ FNMT-RCM SERVIDORES SEGUROS. FNMT opened a CCADB case to mark outdated non-audit documents as superseded and updated the CCADB records so that the latest policy documents were properly disclosed; the CCADB case was closed on May 20, 2025. In the Bugzilla incident report, FNMT stated the delay was caused by outdated internal processes for managing and disclosing policy documents and a lack of understanding of CCADB requirements, including how to mark previous versions as “superseded,” with misinterpretation of CCADB alerts contributing to the delay. FNMT also committed to updating internal procedures and implementing periodic/weekly monitoring to keep CCADB information up to date. The bug is marked RESOLVED with resolution FIXED.
- Updated policy documents for FNMT-RCM roots were published, and Chrome Root Program Policy version 1.6 was released.
- FNMT identified that updated Root Certificate policy documents had not been properly disclosed in the CCADB.
- FNMT updated CCADB records and marked outdated non-audit documents as superseded, then closed the CCADB case.
- FNMT opened a preliminary incident report in Bugzilla.
- FNMT provided a report closure summary and requested closure of the incident report.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Opened a preliminary incident report stating that updated Root Certificate policy documents were not properly disclosed in the CCADB and citing relevant Chrome Root Program and CCADB policy disclosure expectations.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Provided a full incident report with the CCADB unique ID, incident timeline (non-compliance start February 15, identified May 19, ended May 20), and stated that no misissued certificates resulted because the issue was limited to documentation management.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Reported implementation of a process to cross-check policy document versions with CCADB information and updated action items.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Reported an update to the internal CP/CPS review and maintenance procedure and marked action items as complete.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Submitted a report closure summary describing the root cause, the CCADB remediation performed, and commitments to review/update procedures and monitoring.
- CCADB representative — Posted a final call for comments and indicated the incident report would be closed around 2025-07-01.