FNMT delayed revocation of an unexpired SHA-1-signed subordinate CA certificate

FNMT reported that one unexpired SHA-1-signed subordinate CA certificate, "AC Componentes Informáticos," was not revoked by the September 15, 2026 deadline required by the TLS Baseline Requirements. The issue was first notified to FNMT on 2026-09-15, and FNMT confirmed the certificate contained SHA-1. FNMT said no other certificates were affected and that it was preparing the revocation. FNMT later stated that the certificate was revoked on 2026-09-21 and that the incident was resolved. FNMT also said it would provide a further progress update on its remaining action item and asked for the next update date to be set to 2026-10-22.

1. 2026-09-15 The deadline passed for revoking the unexpired SHA-1-signed subordinate CA certificate.
2. 2026-09-21 FNMT revoked the affected SHA-1-signed subordinate CA certificate.
3. 2026-09-29 FNMT filed the full incident report and described the revocation delay and remediation actions.
4. 2026-10-09 FNMT said its formal tracking mechanism for compliance actions was still being implemented and requested a further update date.

1. 2026-09-17 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT opened the bug as a third-party reported incident and said it was preparing to revoke the affected certificate.
2. 2026-09-22 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT said it had revoked the SHA-1 certificate and updated CCADB.
3. 2026-09-29 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT posted the full incident report, including the timeline, impact, and root cause analysis.
4. 2026-10-09 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT said the tracking mechanism action item was progressing and requested the next update be set to 2026-10-22.