DigiCert delayed revocation of SHA-1 issuing CA certificates

This case concerns DigiCert’s failure to revoke two subordinate CA certificates that still used SHA-1 signatures by the required deadline. A third party reported that DigiCert Grid Trust CA had not been revoked by 2026-09-15, and DigiCert later identified a second affected CA, DigiCert EV Code Signing CA. DigiCert said both CAs were not in active use and were revoked on 2026-09-18. DigiCert explained that the deadline was missed because its review of the relevant ballot requirements focused on active issuing hierarchies and did not identify these dormant CAs as in scope. The bug remains assigned to DigiCert, and DigiCert said it has completed two action items and requested a next update date for the final action item.

1. 2011-12-07 DigiCert Grid Trust CA was issued.
2. 2012-04-18 DigiCert EV Code Signing CA was issued.
3. 2026-09-15 SC097 and SMC016 required sunset of remaining SHA-1 signatures in certificates and CRLs.
4. 2026-09-18 The affected subordinate CA certificates were revoked.

1. 2026-09-18 DigiCert — DigiCert filed a preliminary incident report saying a third party reported missed revocation of a SHA-1 issuing CA, and that two affected CAs had now been revoked.
2. 2026-09-28 DigiCert — DigiCert filed the full incident report, stating the revocation deadline was missed because the affected dormant CAs were not identified as in scope.
3. 2026-10-05 DigiCert — DigiCert said it was still working on the action items and would provide an update on or shortly after 2026-10-07.
4. 2026-10-07 DigiCert — DigiCert said action items #1 and #2 were completed and requested a next update date of 2026-11-30 for action item #3.