Actalis: missing CCADB disclosure for subordinate CA certificate
This case concerns Actalis’s failure to disclose a subordinate CA certificate in CCADB. The issue was first reported on 2026-06-24 after Actalis received a third-party report that a subordinate CA certificate chaining to Actalis Authentication Root CA appeared to be missing from CCADB. Actalis said it completed CCADB disclosure for Actalis Code Signing CA G2 on the same day, and later disclosed Actalis Code Signing CA G1 on 2026-06-30. In the full incident report, Actalis said the affected certificate was a subordinate CA certificate used only for code signing, that no end-entity certificates were affected, and that the non-compliance ended on 2026-06-24. The bug remains open and assigned, and the latest update on 2026-09-16 said progress was aligned with the scheduled action items. Weekly updates are still being posted in the bug.
- Actalis Code Signing CA G2 was issued by Actalis Authentication Root CA.
- Apple Root Program disclosure requirements became effective for pre-existing subordinate CA certificates.
- Actalis identified and completed CCADB disclosure for Actalis Code Signing CA G2.
- Actalis disclosed Actalis Code Signing CA G1 in CCADB.
- Staff representative — Opened a preliminary incident report saying a subordinate CA certificate appeared not to be disclosed in CCADB and marked the source as third-party reported.
- Staff representative — Said Actalis had completed CCADB disclosure for Actalis Code Signing CA G2 and would provide further updates.
- Staff representative — Said internal analysis was ongoing, disclosed Actalis Code Signing CA G1 on CCADB, and said it appeared out of scope because it was revoked in 2020.
- Staff representative — Posted the full incident report with the timeline, impact, and policy references.
- Staff representative — Posted a weekly update saying the team was on track with planned action items and continuing to monitor the bug.
- Staff representative — Posted another weekly update saying progress was aligned with scheduled action items.
- Staff representative — Posted a weekly update saying progress was aligned with scheduled action items.
- Staff representative — Posted a weekly update saying progress was aligned with scheduled action items.
- Staff representative — Posted a weekly update saying progress was aligned with scheduled action items.
- Staff representative — Posted a weekly update saying progress was aligned with scheduled action items.
- Staff representative — Posted a weekly update saying progress was aligned with scheduled action items.
- Staff representative — Said the internal procedure governing quarterly self-audits was updated and Action Item 3 was considered complete.
- Staff representative — Posted a weekly update saying progress was aligned with the scheduled action items.
- Staff representative — Posted a weekly update saying progress was aligned with the scheduled action items.