ACCV delayed revocation incident tied to Bugzilla 2061746
ACCV reported a delayed-revocation incident connected to Bugzilla #2061746. The case says ACCV initially calculated the revocation deadline from the end of its internal investigation, but later determined that the five-day deadline started when the Chrome Root Program first reported the CP/CPS discrepancies on 2026-08-04 15:07 CEST. ACCV states that revocation of part of the affected certificate population therefore occurred after the required deadline of 2026-08-09 15:07 CEST. ACCV also said it later reconciled Certificate Transparency data and found additional affected precertificate serial numbers that were not in the original revocation population. By the latest update, ACCV said all identified affected final certificates and precertificates had been revoked and the incident was contained. ACCV said it is finalizing a Full Incident Report and will align the revised report in Bugzilla #2061746 with the reconciled corpus.
- Chrome Root Program reported CP/CPS discrepancies and examples of affected certificates to ACCV.
- ACCV stopped issuance while investigating the matter.
- The five-day revocation deadline ACCV identified passed.
- ACCV completed revocation of all affected final certificates.
- ACCV completed revocation of the additional affected precertificate serial numbers identified through CT reconciliation.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — ACCV filed a preliminary incident report acknowledging the delayed revocation, explaining the deadline calculation, and saying all currently identified affected serial numbers had been revoked.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — ACCV posted a status update stating that 2,231 affected final certificates and 137 affected precertificate serial numbers had all been revoked and that the incident was contained.