Google Trust Services: CP/CPS missing Chrome Root Program and CCADB policy attestation
Google Trust Services reported that its combined CP/CPS was missing an explicit statement confirming adherence to the Chrome Root Program Policy and the CCADB Policy by the June 15, 2026 effective date. The case was opened by Google Trust Services after a third-party inquiry identified the missing statement. GTS said the non-compliance began on 2026-06-15 and ended on 2026-07-27 when CPS v6.8 went live. GTS stated that no certificates were affected and that issuance was not stopped because the certificates were technically valid under the existing CP/CPS prerequisites. GTS later said it had updated internal procedures so that every Root Program requirement must be tracked in a formal ticket, and it completed automated scanning of root program changes against its CP/CPSes. On 2026-10-19, GTS filed a closure summary saying the remediation tasks were complete and requesting closure. On 2026-10-21, CCADB posted a final call for comments and said the bug would be closed around 2026-10-28 if there were no further questions. The bug is now resolved with FIXED.
- Chrome Root Program Section 1.1.3 took effect, creating the CP/CPS attestation requirement.
- An external inquiry identified the missing CP/CPS attestation.
- Google Trust Services mitigated the issue by publishing CPS v6.8.
- Google representative — GTS opened a preliminary incident report saying its CP/CPS was missing the required Chrome Root Program and CCADB policy statement and that a full report would follow.
- Google representative — GTS filed the full incident report, stating the non-compliance period, the mitigation timeline, and that no certificates were affected.
- Google representative — GTS said it had updated internal procedures to require a formal tracking ticket for every Root Program requirement and requested that nextUpdate be set to 2026-10-15.
- Google representative — GTS said the final action item was complete, would monitor the thread for comments, and would submit a closure report if there were none.
- Google representative — GTS submitted a closure summary describing the root causes, completed remediation tasks, and requesting closure.
- CCADB representative — CCADB posted a final call for comments and said the bug would be closed around 2026-10-28 if there were no further questions.