Actalis: Undisclosed Subordinate CA Certificate
This case concerns Actalis’s failure to disclose a subordinate CA certificate in CCADB. The issue was first raised on 2026-06-24 after Actalis received a third-party report that a subordinate CA certificate chaining to Actalis Authentication Root CA appeared to be missing from CCADB. Actalis said it completed disclosure for Actalis Code Signing CA G2 the same day, and later disclosed Actalis Code Signing CA G1 on 2026-06-30. In its full incident report, Actalis said the affected certificate was a subordinate CA certificate used only for code signing, that no end-entity certificates were affected, and that the non-compliance ended on 2026-06-24. The thread remains open and assigned, with weekly updates stating that work is on track and being monitored.
- Actalis Code Signing CA G2 was issued by Actalis Authentication Root CA.
- Apple Root Program disclosure requirements became effective for pre-existing subordinate CA certificates.
- Actalis identified and completed CCADB disclosure for Actalis Code Signing CA G2.
- Actalis disclosed Actalis Code Signing CA G1 in CCADB.
- Staff representative — Opened a preliminary incident report saying a subordinate CA certificate appeared not to be disclosed in CCADB and marked the source as third-party reported.
- Staff representative — Said Actalis had completed CCADB disclosure for Actalis Code Signing CA G2 and would provide further updates.
- Staff representative — Said internal analysis was ongoing, disclosed Actalis Code Signing CA G1 on CCADB, and said it appeared out of scope because it was revoked in 2020.
- Staff representative — Posted the full incident report with the timeline, impact, and policy references.
- Staff representative — Posted a weekly update saying the team was on track with planned action items and continuing to monitor the bug.
- Staff representative — Posted another weekly update saying progress was aligned with scheduled action items.
- Staff representative — Posted a weekly update saying progress was aligned with scheduled action items.