SSL.com delayed disclosure of Timestamping CA in CCADB, with remediation continuing

ASSIGNED SSL.com

This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update. Always refer to the official Bugzilla thread as the authoritative source. If you spot an inaccuracy, let me know via the contact form.

AI Summary

SSL.com reported that its auditor found a subordinate CA certificate, CN = SSL.com Timestamping Issuing RSA CA 2, that had been created in an offline ceremony on 2026-06-12 but was not disclosed to CCADB within the required timeframe. SSL.com said the omission was discovered during audit-related scope checks and later confirmed internally as a missed post-ceremony task. During the same investigation, SSL.com also found that the CRL generated in that ceremony had an incorrect nextUpdate value of 7 days instead of 12 months and had not been posted to the intended URL. SSL.com produced a corrected CRL and added the TSA CA to CCADB on 2026-08-28 at 17:45 UTC. Since the previous update, SSL.com said Action Item #2 is now complete, while Action Item #3 remains ongoing and is due on 2026-10-31. The bug remains open and assigned to SSL.com.

Model: gpt-5.4-mini Generated: 2026-09-06 11:01 UTC Revised: 2026-10-18 07:00 UTC Confidence: 0.96 7 comments

Chronology

2026-06-12 SSL.com created the Timestamping Issuing RSA CA 2 subordinate CA certificate during an offline ceremony.
2026-06-19 The CCADB disclosure deadline passed and the CRL created in the ceremony was allowed to expire.
2026-08-28 SSL.com produced a corrected CRL and added the new TSA CA to CCADB.

Thread Activity

2026-08-27 SSL.com — SSL.com filed a preliminary incident report saying its auditor found the undisclosed subordinate CA certificate and that a full report would follow.
2026-09-10 SSL.com — SSL.com posted the full incident report describing the missed CCADB disclosure and the incorrect CRL nextUpdate, and stating that the TSA CA was added to CCADB after correction.
2026-09-17 SSL.com — SSL.com said remediation action item #1 remained in progress and was expected to be completed by 2026-10-01.
2026-10-01 SSL.com — SSL.com said Action Item #1 was completed, while Action Items #2 and #3 remain ongoing and a further update is requested for 2026-10-16.
2026-10-13 SSL.com — SSL.com reported that a validation job found eight additional subordinate CA certificates that had not been disclosed to CCADB and said seven were disclosed on 2026-09-27 and the eighth on 2026-10-09.
2026-10-16 SSL.com — SSL.com said Action Item #2 is complete and Action Item #3 remains ongoing, with the next update requested for 2026-10-31.

Participants

SSL.com

External References

Original Bugzilla Case bugzilla.mozilla.org crt.sh crt.sh crt.sh crt.sh crt.sh crt.sh crt.sh crt.sh

Related Bugzilla IDs Mentioned

#2076197

Similar Local Cases

#2055250 RESOLVED Ca Certificate Compliance Externally Reported Incident Ccadb Disclosure Issue Problem Reporting Failure Opened 2026-07-15 · Closed 2026-10-13 · 71% similar

D-TRUST: Incomplete Disclosure of CRL URLs

AI Summary CA Owner

#2049012 RESOLVED Ccadb Metadata Update Opened By Ca Ccadb Disclosure Issue Policy Document Issue Opened 2026-06-19 · Closed 2026-08-04 · 71% similar

FNMT: Inaccuracy in CRL URL in CCADB

AI Summary CA Owner

#2082564 ASSIGNED Common Ca Database Ccadb Disclosure Issue Incident Self Reported Incident Opened 2026-10-15 Still Open · 70% similar

FNMT: Late CP/CPS Update in CCADB

AI Summary CA Owner

#2054849 RESOLVED Ca Certificate Compliance Common Ca Database Incident Self Reported Incident Opened 2026-07-14 · Closed 2026-07-30 · 70% similar

Atos: Incorrect CRL URL in CCADB

AI Summary CA Owner

#2066489 ASSIGNED Ccadb Disclosure Issue Remediation Tracking Opened By Ca Single Ca Owner Opened 2026-08-25 Still Open · 70% similar

GoDaddy: CCADB Missing Partitioned CRL URL Disclosure

AI Summary CA Owner

#2055449 RESOLVED Ca Certificate Compliance Incident Ccadb Disclosure Issue Policy Document Issue Opened 2026-07-16 · Closed 2026-08-06 · 70% similar

Firmaprofesional: Delayed and inaccurate policy-document disclosures for SIGNE Autoridad de Certificacion - 2020

AI Summary CA Owner

#2049960 ASSIGNED Ca Certificate Compliance Common Ca Database Ccadb Disclosure Issue Incident Opened 2026-06-24 Still Open · 70% similar

Actalis: Undisclosed Subordinate CA Certificate

AI Summary CA Owner

#2054450 RESOLVED Ca Certificate Compliance Ccadb Disclosure Issue Incident Externally Reported Incident Opened 2026-07-13 · Closed 2026-09-01 · 69% similar

Firmaprofesional: Chrome Root Program Policy - Incorrect CCADB hierarchy associations

AI Summary CA Owner