Actalis: late CP/CPS update for AgID subordinate CAs; bug resolved after closure request
This case concerns Actalis’s failure to publish updated CP/CPS documents for the AgID SSL Server CA and AgID CA1 subordinate CAs within the required annual timeframe. The issue was first reported by a third party, and Actalis said the updated documents and corresponding CCADB disclosures were published on 2026-07-22, 12 days after the applicable deadline. Actalis stated that no end-user certificates were affected and that issuance was not stopped because the problem was limited to document maintenance and disclosure. Since the previous summary, Actalis reported that all remaining action items were completed: the internal procedure was updated on 2026-09-03, the AgID training session was held on 2026-09-22, and the customer-relationships training session was held on 2026-09-25. Actalis then published a closure summary requesting closure, and CCADB issued a final call for comments saying the report would be closed around 2026-10-05 if there were no further questions. The bug is now RESOLVED with FIXED.
- The annual publication deadline for the applicable CP/CPS documents was missed.
- Updated CP/CPS documents were published for the AgID SSL Server CA and AgID CA1 sub-CAs.
- Corresponding CCADB records were updated and the non-compliance ended.
- Actalis updated the internal procedure governing CP/CPS document changes for the AgID-branded subordinate CAs.
- A dedicated training and awareness session with AgID was held and documented.
- A training session for the department responsible for managing customer relationships was held and documented.
- Staff representative — Opened a preliminary incident report saying the published CPS was older than 365 days, the updated documents and CCADB information were published, no end-user certificates were impacted, and a full report would follow.
- Staff representative — Said internal analysis was continuing and that the full incident report would be published within the expected timeline.
- Staff representative — Published the full incident report stating the bug was about failure to publish CP/CPS documents within the required annual timeframe and that the issue was limited to document maintenance and disclosure.
- Staff representative — Said Actalis was on track with the planned action items and was continuing to monitor the bug.
- Staff representative — Repeated that Actalis was on track with the planned action items and was continuing to monitor the bug.
- Staff representative — Repeated that Actalis was on track with the planned action items and was continuing to monitor the bug.
- Staff representative — Repeated that Actalis was on track with the planned action items and was continuing to monitor the bug.
- Staff representative — Said the internal procedure governing CP/CPS document changes was updated on 2026-09-03, so Action Item 2 is complete, and weekly updates will continue.
- Staff representative — Said Actalis was on track with the planned action items and was continuing to monitor the bug.
- Staff representative — Said the dedicated training and awareness session with AgID was held and documented on 2026-09-22, so Action Item 3 is closed, and Action Item 4 was scheduled for 2026-09-25.
- Staff representative — Said the training session for the department responsible for managing customer relationships was held and documented on 2026-09-25, so Action Item 4 is complete.
- Staff representative — Published the closure summary stating the annual CP/CPS update was late, the documents and CCADB disclosures were updated on 2026-07-22, all action items were completed, and closure was requested.
- CCADB representative — Issued a final call for comments or questions and said the incident report would be closed around 2026-10-05 if there were no further questions.