Google Trust Services CP/CPS missing Chrome Root Program and CCADB policy attestation
Google Trust Services reported that its combined CP/CPS did not include an explicit statement confirming adherence to the Chrome Root Program Policy and the CCADB Policy by the June 15, 2026 effective date. The case was opened by Google Trust Services after a third-party report identified the missing statement. GTS said the non-compliance began on 2026-06-15 and ended on 2026-07-27 when CPS v6.8 went live. GTS stated that no certificates were affected and that issuance was not stopped because the certificates were technically valid under the existing CP/CPS prerequisites. In the latest update, GTS said it had completed internal procedural documentation changes so that a formal tracking ticket must be created for every requirement identified during a Root Program policy review. GTS also asked for the nextUpdate field to be set to 2026-10-15.
- Chrome Root Program Section 1.1.3 took effect, creating the CP/CPS attestation requirement.
- An external inquiry identified the missing CP/CPS attestation.
- Google Trust Services mitigated the issue by publishing CPS v6.8.
- Google Trust Services said it had completed internal procedural documentation updates and requested a nextUpdate date.
- Google representative — GTS opened a preliminary incident report saying its CP/CPS was missing the required Chrome Root Program and CCADB policy statement and that a full report would follow.
- Google representative — GTS filed the full incident report, stating the non-compliance period, the mitigation timeline, and that no certificates were affected.
- Google representative — GTS said it had updated internal procedures to require a formal tracking ticket for every Root Program requirement and requested that nextUpdate be set to 2026-10-15.