DigiCert: CCADB Subordinate CA Owner field blank for six revoked cross-certificates; incident report closed after final call
This case concerns a CCADB data accuracy issue in which the "Subordinate CA Owner" field was blank for six DigiCert cross-certificates. DigiCert said a community member reported the issue, and DigiCert agreed that Microsoft controlled the private key and should have been listed as the owner. DigiCert’s report says the affected records were previously revoked on 2026-01-12, the incorrect CCADB entries were introduced on 2026-07-23, and the owner field was restored on 2026-08-04. DigiCert also stated that the issue did not affect certificate issuance or validation and was not a misissuance. DigiCert later said all action items were complete and requested closure. CCADB then issued a final call for comments or questions and said the incident report would be closed around 2026-08-28; the bug is now RESOLVED/FIXED.
- Six cross-certificates were revoked as superseded.
- The Subordinate CA Owner entry was erroneously removed from six cross-certificates in CCADB.
- The Subordinate CA Owner entry was restored for the six cross-certificates.
- DigiCert — DigiCert filed a preliminary incident report, said a community member reported the blank CCADB field, and requested a next update date of 2026-08-08.
- DigiCert — DigiCert said it was still working on the full incident report and would post it on or before 2026-08-08.
- DigiCert — DigiCert posted the full incident report, explained that six cross-certificates were affected, and said the owner field had been restored.
- Mm representative — A commenter asked why the disclosures took 10 days to fix and what tools DigiCert had to detect the non-compliance.
- DigiCert — DigiCert explained the delay was due to caution around combined field settings and said periodic SoR-to-CCADB checks did not flag the changed records because SoR settings had been overridden.
- DigiCert — DigiCert said it completed the action items to review the CCADB Policy-to-SoR mapping and add additional reporting for relevant external SubCA fields.
- DigiCert — DigiCert submitted a closure summary stating that all action items were complete and requested closure.
- CCADB representative — CCADB issued a final call for comments or questions and said the incident report would be closed around 2026-08-28.