Disig CP/CPS and certificate profile keyUsage discrepancy incident; remediation completed and closure requested
This case concerns a discrepancy between Disig’s CP/CPS text and its TLS certificate issuance practice for the keyUsage criticality statement. The issue was first reported by a third party, and Disig later acknowledged that its CP/CPS had stated keyUsage was non-critical even though its technical profiles and issued TLS certificates used critical keyUsage. Disig published an amended CP/CPS v7.3 on 2026-07-20, paused issuance briefly, and then revoked the affected certificates. Disig reported that 356 valid TLS certificates were revoked on 2026-07-23, and later said all action items were completed. The thread also records that Disig’s auditor said the discrepancy had been missed due to human error and that audit procedures were updated. Disig requested closure on 2026-09-04, CCADB asked for a closure summary, and CCADB then issued a final call for comments saying the report would be closed around 2026-09-14. The bug is shown as RESOLVED with FIXED resolution.
- Disig’s CP update changed the keyUsage narrative text from critical to non-critical.
- TLS BR v2.0.0 made keyUsage criticality mandatory for TLS Subscriber Certificates.
- Disig identified the CP/CPS and issuance-practice discrepancy after a third-party report.
- Disig published amended CP/CPS v7.3 correcting the keyUsage statement.
- Disig revoked the affected valid TLS certificates.
- Disig said the policy-to-profile linting tool was completed and the SOP was published.
- Disig posted a closure summary stating that all action items were completed.
- Disig, a.s. — Disig filed a preliminary incident report describing the issue as a CP/CPS misstatement and saying the issued certificates were technically compliant.
- Google representative — Chrome Root Program said the case should not be treated as documentation-only and asked Disig to revise its report and address revocation and review questions.
- Disig, a.s. — Disig accepted that the CP/CPS is a binding commitment, published an amended CP/CPS, and submitted a revised full incident report.
- Google representative — Chrome Root Program asked Disig to answer specific questions about deadlines, review processes, and audit procedures.
- Disig, a.s. — Disig answered questions about its lack of automated CP/CPS conformance checks and said it relied on manual review and BR-focused linters.
- Disig, a.s. — Disig stated that all valid affected TLS certificates had been revoked and attached the revocation list and CRL.
- Disig, a.s. — Disig relayed the auditor’s statement that the issue was caused by human error and that future audits would use a more detailed checklist and comprehensive comparison.
- Disig, a.s. — Disig posted the auditor’s response that comprehensive cross-parameter comparisons were not explicitly integrated into past audit cycles and that the audit methodology had been updated.
- Disig, a.s. — Disig said the policy-to-profile linting tool was completed and a formal SOP was published for future CP/CPS releases.
- Disig, a.s. — Disig requested closure because all action items were completed and there had been no further comments for seven days.
- CCADB representative — CCADB asked Disig to accompany the closure request with a closure summary.
- Disig, a.s. — Disig posted a closure summary describing the discrepancy, remediation, and completion of all action items.
- CCADB representative — CCADB issued a final call for comments and said the report would be closed around 2026-09-14.