Apple audit report omitted 2 subordinate CAs; remediation completed and bug closed

Apple reported that its 2026 WebTrust audit reports did not include two subordinate CA certificates that had been created on 2026-02-04 and should have been listed in the WTCA, WTBR, and WTNS reports. Apple said the certificates were included in the audit work, but were omitted from the final report’s list of covered subordinate CAs. Sectigo notified Apple after ALV returned errors when the audit documents were uploaded to CCADB. Apple chose to revoke both subordinate CA certificates rather than seek a revised audit report, and later said the revocation was complete and all action items were finished. Apple requested closure of the incident, and CCADB issued a final call for comments before closing the bug. The bug is now resolved.

1. 2026-02-04 Apple created two subordinate CA certificates.
2. 2026-06-29 The audit non-compliance period began because the audit reports did not include the two subordinate CAs.
3. 2026-06-30 Apple identified the non-compliance after Sectigo reported ALV upload errors.
4. 2026-08-05 Apple completed revocation of both subordinate CA certificates.
5. 2026-08-07 Apple requested closure after stating that all action items were complete.
6. 2026-08-09 CCADB issued a final call for comments and said the incident report would be closed around 2026-08-17.

1. 2026-07-02 Apple representative — Apple filed a preliminary incident report saying the 2026 WebTrust audit reports omitted two sub-CAs and that Sectigo had reported ALV upload errors in CCADB.
2. 2026-07-16 Apple representative — Apple posted the full incident report stating the certificates were sampled in the audit but omitted from the final report, and said it would revoke both subordinate CA certificates.
3. 2026-07-16 Apple representative — Apple created the Certificate_details.csv attachment.
4. 2026-07-20 Apple representative — Apple said it had discussed revocation with Sectigo, scheduled revocation for 2026-08-05, and requested the next update field be set to 2026-08-06.
5. 2026-08-07 Apple representative — Apple said the revocation was completed, the remediation action items were complete, and requested closure of the bug.
6. 2026-08-09 CCADB representative — CCADB posted a final call for comments or questions and said the incident report would be closed on approximately 2026-08-17.