Certum third-party report on legacy subordinate CAs missing EKU
Certum opened this case after receiving a third-party Certificate Problem Report on 2026-09-15 about three unexpired, unrevoked subordinate CA certificates under the legacy multi-purpose Certum Trusted Network CA. The reporter alleged that the subordinate CA certificates lacked the extendedKeyUsage extension and therefore did not comply with Chrome Root Program Policy Section 1.3.2. Certum said the affected hierarchy is part of its ongoing transition to dedicated single-purpose PKI hierarchies and that the subordinate CAs had not been used to issue new TLS subscriber certificates since September 2025. Chrome Root Program staff replied that the report should be resolved as Invalid, saying Certum met the policy criteria and had been granted a case-by-case transition exception. The thread then moved to comments about whether the exception terms and the Chrome response should be published or linked, and CCADB issued final calls for comments before planned INVALID closure.
- Certum received a third-party report about three unexpired subordinate CA certificates lacking EKU under the legacy multi-purpose hierarchy.
- Certum filed a preliminary incident report in Mozilla Bugzilla describing the report and its interpretation of the transition exception.
- Chrome Root Program staff said the case should be resolved as Invalid.
- CCADB indicated the report would be closed as INVALID if no further comments were received.
- Assecods representative — Certum described the third-party report, the missing EKU allegation, and its view that the certificates were covered by transition arrangements.
- Google representative — Chrome Root Program staff agreed the report should be resolved as Invalid and said a case-by-case transition exception had been granted.
- Assecods representative — Certum asked to proceed with closure as Invalid.
- CCADB representative — CCADB issued a final call for comments and said the report would be closed as INVALID around 2026-10-02.
- Community commenter — A commenter asked Chrome Root Program to address outstanding questions and to publish or link the operative terms of Certum’s exception.
- CCADB representative — CCADB asked the commenter to differentiate the Chrome response in this bug from what they expected to be added here.
- CCADB representative — CCADB issued another final call for comments and said the report would be closed as INVALID around 2026-10-19.