FNMT CCADB incident: incorrect CRL URI entry corrected, remediation completed, report closed
FNMT reported that an incorrect CRL URI was recorded in CCADB for the root CA certificate AC RAIZ-FNMT RCM G2 during a root information update. The issue was identified after a third-party report, and FNMT corrected the CCADB entry so the valid CRL URI matched the certificate. FNMT stated that the impact was limited to the CCADB administrative portal and did not affect certificate issuance, revocation, or validation behavior. FNMT said the update process lacked a mandatory secondary review, which allowed the incorrect value to go undetected. As remediation, FNMT added a second-review step and updated CCADB validation checks to verify CRL URL consistency between certificates and CCADB records. FNMT filed a closure summary on 2026-07-24 saying all action items were complete and requesting closure, and CCADB posted a final call for comments on 2026-07-27 before closing the report.
- An incorrect CRL URI was recorded in CCADB for AC RAIZ-FNMT RCM G2 during a root information update.
- FNMT corrected the CCADB record and updated the CRL URI to the valid value.
- FNMT published a preliminary incident report on Bugzilla.
- FNMT published a full incident report on Bugzilla.
- FNMT completed the CCADB checks update and filed a report closure summary requesting closure.
- CCADB issued a final call for comments before closing the incident report.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Filed a preliminary incident report saying an incorrect CRL URI had been recorded in CCADB and that the valid URI had been updated.
- Community commenter — Said the issue had been reported to FNMT on June 10 and raised concerns that FNMT had not proactively disclosed the CCADB inaccuracy.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Explained the matter was initially treated as a CCADB data correction, then reevaluated as disclosure-relevant, and said a separate ticket tracked disclosure timeliness.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Published the full incident report with timeline, impact, and CCADB policy references.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Added a verification step and four-eyes review process for CCADB updates and updated action items.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Said there were no new updates and that the next update would be provided on July 24.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Reported that CCADB checks had been updated and that the revised checklist was now used by the Quality team.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Submitted a closure summary stating the incorrect entry was corrected, second review was added, validation checks were updated, and all action items were complete.
- CCADB representative — Posted a final call for comments or questions and said the report would be closed around 2026-08-03 if there were none.