Firmaprofesional: Delayed and inaccurate CCADB policy-document disclosures for SIGNE Autoridad de Certificacion - 2020 (CPS 4.0/4.1)
Autoridad de Certificacion Firmaprofesional reported an incident involving the subordinate CA “SIGNE Autoridad de Certificacion - 2020” (CCADB record ID 0011J00001jt6LCQAY). On 2026-07-14 00:10 UTC, Firmaprofesional received an external report that crt.sh was showing Mozilla disclosure alerts for outdated policy-document metadata in the CCADB record. Firmaprofesional’s investigation found that SIGNE published CPS version 4.0 (effective 2025-10-17) and CPS version 4.1 (effective 2026-06-11) in its public repository, but the CCADB record still disclosed CPS version 3.7 (effective 2024-07-04) as an active policy document. The updated CPS versions were not submitted to CCADB within the required 14-calendar-day period. As initial remediation, Firmaprofesional added CPS version 4.1 to the CCADB record and noted that crt.sh no longer displays the corresponding document-age alert; they continued verifying effective/superseded dates and the final CCADB state. The incident was described as ongoing, with impact limited to outdated/inaccurate CCADB policy-document metadata for the subordinate CA record.
- SIGNE published CPS version 4.0 effective 2025-10-17.
- CCADB record disclosed CPS version 3.7 effective 2024-07-04 as active.
- SIGNE published CPS version 4.1 effective 2026-06-11.
- Firmaprofesional received an external report that crt.sh showed Mozilla disclosure alerts for outdated CCADB policy-document metadata for the SIGNE subordinate CA record.
- Firmaprofesional added CPS version 4.1 to the CCADB record as initial remediation.
- Autoridad de Certificacion Firmaprofesional — Firmaprofesional submitted a preliminary incident report stating that CCADB policy-document metadata for SIGNE’s CPS was outdated due to delayed submission, and that they updated the CCADB record with CPS 4.1, with crt.sh no longer showing the related alert.