ACCV delayed revocation incident with ongoing remediation tracking
This case concerns ACCV’s delayed revocation incident tied to the CP/CPS non-compliance reported in Bugzilla #2061746. ACCV said the applicable five-day revocation deadline should have been counted from the Chrome Root Program’s report on 2026-08-04 15:07 CEST, not from the end of ACCV’s internal investigation. ACCV also said its original revocation population was incomplete because it was not independently reconciled against all affected Certificate Transparency precertificates. In the full incident report, ACCV said 2,222 completed final certificates and 137 CT-only precertificate issuer-and-serial-number combinations were revoked after the deadline, while 9 final certificates had been revoked before the deadline. ACCV said all identified affected certificates and precertificates have now been revoked and the incident is contained. The latest thread updates say ACCV is still working on procedural and implementation changes to the mass-revocation process, with corrective actions being tracked in the parent incident report in Bugzilla #2061746.
- Chrome Root Program reported CP/CPS discrepancies and examples of affected certificates to ACCV.
- ACCV stopped issuance while investigating the matter.
- The five-day revocation deadline ACCV identified passed.
- ACCV completed revocation of all affected final certificates.
- ACCV completed revocation of the additional affected precertificate serial numbers identified through CT reconciliation.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — ACCV filed a preliminary incident report acknowledging the delayed revocation and saying all currently identified affected serial numbers had been revoked.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — ACCV reported that 2,231 affected final certificates and 137 affected precertificate serial numbers had all been revoked and that the incident was contained.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — ACCV filed the full incident report stating that 2,222 final certificates and 137 CT-only precertificate issuer-and-serial-number combinations were revoked after the deadline.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — ACCV said the revocation process was complete and that remaining work was monitoring and reporting corrective and preventive actions in Bugzilla #2061746.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — ACCV said it was working on amendments to the revocation plan, both procedurally and in implementation, while continuing to track the remaining actions in Bugzilla #2061746.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — ACCV said it continues working with the development team on procedural and implementation changes related to the mass-revocation process and that no additional changes are available in this ticket.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — ACCV said it continues working on the procedural and implementation changes related to the mass-revocation policy and process.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — ACCV said it continues working on the procedural and implementation changes related to the mass-revocation policy and process and hopes to provide an update soon.