SDAIA self-reported missing S/MIME WebTrust audit coverage; bug closed after Microsoft trust restriction and revocation completion
SDAIA reported that its Saudi National PKI hierarchy, including Saudi National Root CA and Government CA 2, had been issuing S/MIME certificates without the required WebTrust for CA - S/MIME Baseline Requirements audit coverage. SDAIA said the gap was found during an internal compliance review and self-reported the incident. In response, SDAIA stopped S/MIME issuance, notified affected subscribers, revoked all 1,045 affected certificates, and requested Microsoft to remove the S/MIME trust capability from the hierarchy. Microsoft implemented the trust change as a NotBefore restriction effective 2026-09-15, and SDAIA later confirmed that Action Item 1 was complete. On 2026-09-16, SDAIA filed a report closure summary stating that the remaining revocation-timing issue is tracked in Bug 2058294. The bug was then closed with resolution FIXED after CCADB’s final call for comments.
- CA/B Forum S/MIME Baseline Requirements became effective for the hierarchy.
- The non-compliance period for missing S/MIME audit coverage began.
- SDAIA identified that the hierarchy remained technically capable of issuing S/MIME certificates without the required audit coverage.
- SDAIA suspended S/MIME issuance under the affected hierarchy.
- SDAIA revoked the last of the affected S/MIME certificates.
- Microsoft’s S/MIME trust restriction for the affected hierarchy became effective.
- Sdaia representative — SDAIA said it had not conducted the required S/MIME audit for Saudi National Root CA and Government CA 2 and was self-reporting the incident.
- Sdaia representative — SDAIA posted the full incident report and said all issued S/MIME subscriber certificates were considered misissued.
- Sdaia representative — SDAIA reduced the affected population to 1,045 certificates and said remaining revocations were tracked in Bug 2058294.
- Sdaia representative — SDAIA said all affected S/MIME certificates had been revoked and only the trust-bit removal action remained open.
- Sdaia representative — SDAIA said Microsoft had published and distributed the restriction and moved the due date for Action Item 1 to 2026-09-15.
- Sdaia representative — SDAIA filed a closure summary saying Action Item 1 was complete and that the delayed-revocation issue is in Bug 2058294.
- CCADB representative — CCADB issued a final call for comments or questions and said the incident report would be closed around 2026-09-23.