FNMT-RCM: Delayed preliminary findings notification to CPR reporter (BR §4.9.5)
FNMT-RCM received a Certificate Problem Report (CPR) via email on 2026-01-23 from a third-party reporter. FNMT-RCM investigated the reported facts and circumstances and determined the affected certificate required revocation, and the certificate was revoked within 24 hours. However, FNMT-RCM did not provide the preliminary report findings to the entity that filed the CPR within the 24-hour timeframe required by CA/B Forum Baseline Requirements section 4.9.5. The omission was identified after the reporter requested a status update, and the preliminary findings were then sent to the CPR reporter on 2026-02-05. FNMT-RCM attributed the delay to a procedural limitation in its CPR notification workflow, which only covered preliminary notifications to recognized entities. The communication procedure was updated to include all notification and timing requirements, and the incident report was requested for closure as completed.
- FNMT-RCM received a CPR via email and initiated an investigation; the affected certificate was revoked within 24 hours.
- FNMT-RCM sent the preliminary findings to the CPR reporter after the 24-hour requirement was missed.
- FNMT-RCM submitted a report closure summary and requested closure of the incident report.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT-RCM reported that it revoked the affected certificate within 24 hours but did not provide the preliminary report to the CPR sender within 24 hours as required by BR §4.9.5.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT-RCM provided a full incident report describing the procedural gap in its CPR notification workflow and the timeline, and stated that the preliminary findings were later sent to the reporter.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT-RCM requested closure, stating the communication procedure was updated and that action items were completed as described.
- CCADB representative — CCADB issued a final call for comments before closing the incident report on approximately 2026-03-02.