ACCV self-reported TLS CP/CPS non-compliance; remediation continues
ACCV reported a TLS certificate compliance incident after Chrome Root Program review identified discrepancies between ACCV’s binding CP/CPS and publicly trusted server TLS certificates it had issued. ACCV confirmed two discrepancies: 20-octet serial numbers where its CP/CPS described 16-octet random serials, and a Subject RDN ordering difference from the order made normative in the CP/CPS. ACCV said the affected certificates were not issued in accordance with its own CP/CPS, corrected the CP/CPS on 2026-08-06, and stopped issuance using the affected profiles while it investigated. ACCV later revised its full incident report to say the originally disclosed affected population was incomplete because it had not been fully reconciled against CT-only precertificates; it identified 137 additional CT-only precertificates and said every corresponding issuer-and-serial-number combination has been revoked. The thread also records that the delayed-revocation issue is tracked separately in Bugzilla #2064673. ACCV’s latest updates say remediation work is still ongoing, including revising the TLS CP/CPS, updating application logic, and improving the mass-revocation process.
- ACCV began issuing certificates under the affected policy language with the serial-number discrepancy.
- Chrome Root Program notified ACCV of potential discrepancies between issued certificates and ACCV’s CP/CPS.
- ACCV confirmed the non-compliance and published corrected CP/CPS version 4.0.23.
- ACCV completed revocation of the original population of affected final certificates.
- ACCV revoked additional affected precertificates identified after expanding the investigation.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — ACCV opened a preliminary incident report describing Chrome-identified CP/CPS discrepancies and said affected certificates would be replaced and revoked within five days.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — ACCV filed a full incident report stating the certificates were not issued in accordance with its CP/CPS and that the issue was third-party reported during Chrome Root Program review.
- Community commenter — A commenter said the revocation timeline appeared to miss the five-day deadline and asked why some affected precertificates were not on the revocation lists.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — ACCV accepted the 2026-08-04 15:07 CEST notice as the revocation start date, acknowledged delayed revocation, and said the original affected population was incomplete.
- Google representative — Chrome Root Program asked about several revocations that appeared to lack a reasonCode and expected CRLReason superseded.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — ACCV said the questioned certificates had already been revoked by subscribers before the mass revocation batch and explained the reasonCode differences.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — ACCV posted a revised full incident report that superseded the prior report, corrected the revocation timeline and affected population, and said the delayed-revocation incident is tracked separately in Bugzilla #2064673.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — ACCV said it is still working on corrective actions, including revising its TLS CP/CPS, application logic, and mass-revocation process.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — ACCV said work on the planned remediation actions is continuing, including drafting the updated policy, preparing Git deployment, and coordinating application changes.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — ACCV said it continued work on CP/CPS-to-production reconciliation and noted a new cross-certificate for the 2024 TLS hierarchy as part of the transition work.