DigiCert: Issues with CCADB entries (CP/CPS marked Superseded in CCADB reports)
DigiCert filed a CA Program bug after receiving a third-party report about a potential problem with its CCADB entries. In the report, CCADB reports were showing no valid CP/CPS for many DigiCert CAs, and DigiCert stated the issue was largely within CCADB rather than a DigiCert disclosure failure. DigiCert said it had published CP/CPS v7.07 to CCADB (Case 00002755, Non-Audit Doc ID 9045) without a superseded date, but CCADB support clarified that during syncing Doc ID 9045 became Doc ID 4350 and that duplicate CP/CPS records were created by CCADB automated document download. CCADB support confirmed that merging the duplicate CP/CPS v7.07 records (same URL and effective date) and clearing superseded dates would reactivate the intended document and eliminate duplicates. DigiCert requested the bug be closed as INVALID, and Mozilla agreed; DigiCert later reported confirmation that the duplicate records had been merged and the report error resolved. The bug was ultimately marked RESOLVED with resolution INVALID.
- DigiCert published CP/CPS v7.07 to CCADB as Case 00002755 with Non-Audit Doc ID 9045.
- The CCADB case was closed and DigiCert confirmed correctness in CCADB; Doc ID 9045 converted to Doc ID 4350.
- DigiCert noticed CCADB reporting showed no valid CP/CPS for some cases while troubleshooting another bug.
- A third-party report was received by DigiCert identifying the CCADB reporting issue.
- DigiCert requested the bug be closed as INVALID after confirmation from CCADB support that the issue was in CCADB reporting.
- CCADB confirmed the duplicate CP/CPS v7.07 records were merged into a single Doc ID and the report error was resolved.
- DigiCert — DigiCert reported that it received a third-party report about potential problems with its CCADB entries and said investigation was awaiting CCADB support.
- Sectigo — Sectigo asked why DigiCert had not corrected CCADB by clearing the Superseded Date field if CP/CPS v7.07 was still intended to be current.
- CCADB representative — CCADB incident reporting explained that automated downloads returned error-page content despite HTTP 200 responses, creating duplicate CP/CPS document records that remained superseded.
- DigiCert — DigiCert stated CP/CPS v7.07 was published without a superseded date and that CCADB support clarified Doc ID changes and duplicate-record behavior; DigiCert approved remediation and requested INVALID.
- Sectigo — Sectigo thanked DigiCert and asked when the remediation would be implemented.
- Google representative — Google commented that the incident could be more specific and discussed how CCADB superseded documents affect reporting and document associations.
- DigiCert — DigiCert submitted a full incident report stating the issue was a CCADB reporting error and reiterated that it requested closure as INVALID.
- Mozilla representative — Mozilla agreed the bug could be closed with resolution INVALID.
- CCADB representative — CCADB incident reporting issued a final call for comments and said the incident report would be closed as INVALID around 2026-02-18.