Firmaprofesional: delayed and inaccurate CCADB policy-document disclosures for SIGNE Autoridad de Certificacion - 2020

Autoridad de Certificacion Firmaprofesional reported that its subordinate CA SIGNE Autoridad de Certificacion - 2020 published CPS versions 4.0 and 4.1 in its public repository, but those updates were not submitted to CCADB within 14 calendar days of their effective dates. The case was triggered by an external report pointing to Mozilla disclosure alerts on crt.sh for outdated policy-document metadata. Firmaprofesional said the impact was limited to CCADB policy-document disclosure metadata and that no certificate misissuance, revocation impact, or audit impact was identified. The company later corrected the active CCADB CPS URL so that CPS 4.1 became the active record. In its closure summary, Firmaprofesional said the root cause was the lack of a formal communication workflow linking SIGNE CPS changes to the required CCADB update process. The bug is resolved, with a final call for comments posted and closure indicated for around 2026-08-06 if there were no further questions.

1. 2024-07-04 SIGNE CPS version 3.7 became effective and was disclosed in CCADB.
2. 2025-10-17 SIGNE CPS version 4.0 became effective and was published in SIGNE's public repository.
3. 2026-06-11 SIGNE CPS version 4.1 became effective and was published in SIGNE's public repository.
4. 2026-07-14 An external report alerted Firmaprofesional to outdated CCADB policy-document metadata for SIGNE.
5. 2026-07-24 Firmaprofesional updated the CCADB CPS URL so CPS 4.1 became the active record.

1. 2026-07-16 Autoridad de Certificacion Firmaprofesional — Reported that CPS 4.0 and 4.1 had not been submitted to CCADB within 14 days and that the incident remained ongoing.
2. 2026-07-23 Autoridad de Certificacion Firmaprofesional — Said verification confirmed CPS 4.1 was the only displayed policy-document record without a superseded date and that the incident remained ongoing.
3. 2026-07-27 Autoridad de Certificacion Firmaprofesional — Filed the Full Incident Report describing the missed CCADB submissions, the non-compliance timeline, and the limited scope of the issue.
4. 2026-07-30 Autoridad de Certificacion Firmaprofesional — Submitted the closure summary with the root cause, remediation steps, and completed action items.
5. 2026-07-30 CCADB representative — Posted a final call for comments and said the bug would be closed around 2026-08-06 if there were no further questions.