Google Trust Services: Missing authorization audit log entry for certificate issuance

Google Trust Services (GTS) reported an incident where a certificate was issued without recording an authorization event in the audit log due to a race condition. The issue was identified by GTS's self-auditing tool, which flagged the missing log detail shortly after the certificate was issued. GTS revoked the affected certificate and developed a fix to prevent recurrence. They have completed a full incident report detailing the root cause and remediation steps, including updates to their code and improvements to their auditing processes. GTS is committed to ongoing monitoring and enhancements to their systems.

1. 2025-07-22 Certificate issued without proper audit log entry.
2. 2025-07-25 Incident identified and certificate revoked.
3. 2025-10-09 Final report on incident closure submitted.

1. 2025-07-25 Google representative — GTS was alerted by our self-auditing tool of a missing log detail for one certificate.
2. 2025-08-06 Google representative — Full incident report published detailing the root cause and remediation steps.
3. 2025-10-09 Google representative — GTS completed all action items and requested closure of the incident report.