Firmaprofesional CCADB hierarchy association incident closed after remediation and final call for comments
This case concerns Firmaprofesional’s CCADB hierarchy metadata for seven subordinate CA certificate records that were initially associated only with a 2009 self-signed root record and not with the Chrome-included 2014 root record, even though the two roots share the same Subject and SPKI. The issue was first reported by the Chrome Root Program on 2026-07-10, and Firmaprofesional’s reconciliation expanded the scope from four records to seven. Firmaprofesional updated the `Parent CA Owner/Certificate` field for all seven records on 2026-07-10 and later published a full incident report on 2026-07-24. On 2026-08-14, Firmaprofesional said the remaining action item had been completed and that all action items in the full incident report were complete. On 2026-08-19, Firmaprofesional posted a closure summary stating that the procedure had been updated, the full corpus review found no additional affected records, and all action items had been completed. On 2026-08-25, CCADB incident-reporting posted a final call for comments or questions and said the report would be closed around 2026-09-01. The bug is marked RESOLVED/FIXED.
- Chrome Root Program notified Firmaprofesional that four subordinate CA records were associated only with the 2009 root record instead of the Chrome-included 2014 root record.
- Firmaprofesional updated the parent association for the seven affected subordinate CA records to the 2014 root record.
- Firmaprofesional published the full incident report confirming the seven-record scope and the corrected parent association.
- Firmaprofesional said the remaining action item had been completed and that all action items were now complete.
- Firmaprofesional posted a closure summary requesting closure after completing remediation and procedure updates.
- CCADB incident-reporting posted a final call for comments and said the report would be closed around 2026-09-01.
- Autoridad de Certificacion Firmaprofesional — Firmaprofesional posted a preliminary incident report describing the incorrect CCADB hierarchy associations and the seven affected records.
- Autoridad de Certificacion Firmaprofesional — Firmaprofesional said its investigation and full incident report preparation were still in progress and requested a next update date of 2026-07-27.
- Autoridad de Certificacion Firmaprofesional — Firmaprofesional posted the full incident report, confirmed the seven-record scope, and said the parent association had been changed to the 2014 root.
- Autoridad de Certificacion Firmaprofesional — Firmaprofesional said work on the remaining open action item was still in progress and requested next update be set to 2026-08-15.
- Autoridad de Certificacion Firmaprofesional — Firmaprofesional said the remaining action item had been completed and that all action items in the full incident report were now complete.
- Autoridad de Certificacion Firmaprofesional — Firmaprofesional posted a report closure summary describing the root cause, remediation, updated disclosure procedure, and request for closure.
- CCADB representative — CCADB incident-reporting posted a final call for comments or questions and said the incident report would be closed around 2026-09-01.