← Carillon Information Security Inc. cases
Bugzilla #2015564
Self Reported Incident
Carillon Information Security: Missing Contact Information in CCADB
RESOLVED
WONTFIX
Carillon Information Security Inc.
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Carillon Information Security Inc. was found to have missing required contact information in the Common CA Database (CCADB), specifically the fields 'CA Email Alias 1' and 'CA Email Alias 2'. This issue was reported by Dustin Hollenback from Apple on February 9, 2026, after Carillon was notified on January 3, 2026, but failed to update the information. Carillon submitted a case to update the contact information but initially misunderstood the requirements. Although the CCADB was eventually updated, there were delays in providing a complete incident report as required by CCADB guidelines. Ultimately, Carillon decided to remove its root CA from the Microsoft Trust Store, indicating a shift in their operational strategy.
Chronology
- Notification sent to Carillon about missing contact information.
- Bug opened regarding the missing contact information.
- Carillon requested to remove its root CA from the Microsoft Trust Store.
Thread Activity
- Apple representative — Reported missing contact information in CCADB.
- Carillon representative — Submitted a case with the requested information.
- Carillon representative — Provided an incident report regarding the missing email aliases.
- Carillon representative — Requested removal of root CA from Microsoft Trust Store.
Participants
Community commenter
External References
Similar Local Cases
Identrust: Root CrossSign, of dedicated Roots, missing EKU
SwissSign: Undisclosed Intermediate Certificates
Microsec: Inconsistent Disclosure of S/MIME BR Audit Information in CCADB
LuxTrust: Outdated audit statement for intermediate certificate
D-Trust: CRL HTTP Media Type
CFCA: Failed to respond a Certificate Problem Report within 24 hours which violates Section 4.9.5 of the TLS BRs
Actalis: missing CCADB disclosure for new SubCA
Camerfirma: Outdated audit statements for intermediate certs