Firmaprofesional Chrome Root Program policy incident for dedicated TLS hierarchy / EKU requirements
Firmaprofesional opened this case after Chrome Root Program notified it that seven unexpired, unrevoked subordinate CA certificates under the Chrome-included root `Autoridad de Certificacion Firmaprofesional CIF A62634068` did not meet Chrome’s dedicated TLS server authentication hierarchy requirements. The company’s full report says the affected subordinate CAs had EKU profiles outside the dedicated TLS hierarchy requirement, and Chrome responded by applying an `SCTNotAfter` phase-out mechanism. Firmaprofesional said it would not seek an exemption or replacement Chrome-trusted root for this hierarchy and would request voluntary removal of the affected root from the applicable browser root programs. Since then, Firmaprofesional reported that all publicly trusted WebPKI TLS certificate profiles were transitioned to DigiCert, that publicly trusted TLS issuance from the legacy hierarchy has ceased, and that the voluntary phase-out and removal requests were submitted to the applicable root programs. On 2026-09-18, Firmaprofesional stated that it maintains its view that the Chrome policy violation does not, by itself, require revocation of the seven affected subordinate CA certificates under TLS Baseline Requirements Section 4.9.1.2(5). The latest update says the remaining work is limited to verifying Chrome’s `sctNotAfter` deployment and confirming the corrected cutoff value in public Chromium/Chrome Root Store metadata. The bug remains open and assigned.
- Chrome Root Program dedicated TLS hierarchy requirements became applicable to existing Chrome-included roots.
- Chrome notified Firmaprofesional that subordinate CA certificates validating to `Autoridad de Certificacion Firmaprofesional CIF A62634068` did not meet the dedicated TLS hierarchy requirements.
- Firmaprofesional filed its full incident report, confirmed seven affected subordinate CA certificates, and said it would request voluntary removal of the affected root from the applicable browser root programs.
- Firmaprofesional said the transition of remaining publicly trusted TLS certificate profiles to DigiCert was completed.
- Firmaprofesional said it had created a new ECC hierarchy before the deadline but did not obtain a publicly trusted replacement hierarchy in time, and it acknowledged a separate CP/CPS documentation compliance failure.
- Firmaprofesional said it is maintaining its determination that the Chrome policy violation does not by itself require revocation of the seven affected subordinate CA certificates.
- Firmaprofesional reported that the remaining technical-control work was completed and that Chrome confirmed the final `sct_not_after_sec` value.
- Firmaprofesional said deployment confirmation for Chrome’s corrected `sct_not_after_sec` value was still pending in public Chromium/Chrome Root Store metadata.
- Autoridad de Certificacion Firmaprofesional — Filed a preliminary incident report describing Chrome’s notification, listing seven affected subordinate CA certificates, and stating that Firmaprofesional would proceed with Chrome’s phase-out.
- Autoridad de Certificacion Firmaprofesional — Corrected a drafting error in the preliminary report and said the investigation and full report preparation were still in progress, with no change to the seven-certificate scope.
- Autoridad de Certificacion Firmaprofesional — Posted the full incident report, confirmed the seven-certificate scope, and stated that Firmaprofesional would request voluntary removal of the affected root from the applicable browser root programs.
- Autoridad de Certificacion Firmaprofesional — Reported that the DigiCert transition action item was completed, that publicly trusted WebPKI TLS issuance had ceased under the legacy hierarchy, and that the remaining action items were still in progress.
- Community commenter — Questioned whether the non-compliant subordinate CA certificates should have been revoked and whether the case also reflected a policy-compliance failure.
- Autoridad de Certificacion Firmaprofesional — Said it was technically possible to issue replacement subordinate CA certificates and migrate services, but that the replacement hierarchy was not available in time; it also confirmed a separate documentation compliance failure and pointed to Bug 2068900.
- Community commenter — Argued that the continuing Section 1.3.2 violation could still trigger revocation obligations and asked for a delayed-revocation report if applicable.
- Autoridad de Certificacion Firmaprofesional — Said further policy reconciliation was needed before a certificate-specific conclusion could be drawn and discussed the scope of the applicable CP/CPS documents.
- Autoridad de Certificacion Firmaprofesional — Stated that Firmaprofesional maintains its determination that the Chrome policy violation does not by itself require revocation of the seven affected subordinate CA certificates, and said it would provide the next consolidated status update by 2026-09-25.
- Autoridad de Certificacion Firmaprofesional — Reported that the remaining technical-control work was completed, that Chrome confirmed the final `sct_not_after_sec` value, and that the bug should remain open pending Chrome deployment verification.
- Autoridad de Certificacion Firmaprofesional — Said the remaining work is limited to confirming the corrected `sct_not_after_sec` value in public Chromium configuration and Chrome Root Store metadata, with deployment confirmation still pending.