GlobalSign self-reported incident: SubCA created with incorrect CPS Policy OID; report closed
GlobalSign reported that it discovered, during an internal CCADB review, one SubCA certificate that had been created with the wrong CPS Policy OID. The affected certificate was DHL Global TLS CA I6, which contained `1.3.6.1.4.1.4146.1.2` instead of the intended OV TLS OID `1.3.6.1.4.1.4146.10.1.2`. GlobalSign said issuance under the affected CA was stopped and that the CA was revoked on 2026-08-04, leaving no remaining valid certificates. It later said it completed the remedial actions on 2026-08-17, adding explicit CPS OID verification to the approval procedure and programmatic comparison of Policy OIDs against the CP/CPS. On 2026-08-25, GlobalSign posted a closure summary stating that all disclosed action items were complete and requested closure. CCADB then issued a final call for comments on 2026-08-26 and said the report would be closed around 2026-09-02 if there were no further questions.
- DHL Global TLS CA I6 was created with the incorrect CPS Policy OID.
- GlobalSign identified the incorrect CPS Policy OID during an internal CCADB review.
- GlobalSign revoked the affected CA certificate.
- GlobalSign completed the remedial actions to verify CPS OIDs in approval and compare OIDs programmatically.
- GlobalSign posted a closure summary and requested closure of the incident report.
- GlobalSign nv-sa — GlobalSign filed a preliminary incident report saying it had found the issue during internal CCADB review and would provide a full incident report by 2026-08-04.
- GlobalSign nv-sa — GlobalSign filed the full incident report, described the incorrect CPS Policy OID, said issuance was stopped, and stated that the affected CA had been revoked.
- GlobalSign nv-sa — GlobalSign said it was on track to deliver both action items by 2026-08-17 and requested the next update be set for 2026-08-18.
- GlobalSign nv-sa — GlobalSign said it completed the remedial actions on 2026-08-17 and would post a closure report by 2026-08-25.
- GlobalSign nv-sa — GlobalSign posted a closure summary and said all disclosed action items were complete, requesting closure.
- CCADB representative — CCADB issued a final call for comments or questions and said the report would be closed around 2026-09-02 if there were none.