SSL.com audit finding: root CA certificates were not published in the repository required by the CP/CPS
SSL.com reported an audit finding that six Root CA certificates acquired from VikingCloud were described in its CP/CPS as part of the SSL.com PKI, but were not published in the SSL.com repository as required by the CP/CPS. The issue was identified by SSL.com’s external auditors during the 2025–2026 audit period and was disclosed as a preliminary incident report, then expanded into a full incident report. SSL.com said the affected roots were present in CCADB, but were absent from the repository until 2026-07-30 15:44 UTC, after the auditors had raised the finding. SSL.com stated that no end-entity certificates were affected and that the issue concerned publication of root CA certificates, not misissuance. The thread also notes that the roots were in the process of being removed from public root stores as part of a transition to private trust usage. SSL.com said an action item to update onboarding procedures for acquired CAs remains ongoing, with the next update requested for 2026-10-23.
- SSL.com published CP/CPS v1.29, listing six VikingCloud roots as Root CA Certificates of the SSL.com PKI effective 2026-03-06.
- The CP/CPS took effect, but the six roots were not present in the SSL.com repository.
- The audit period ended with the six roots still absent from the repository.
- SSL.com added the VikingCloud Root CA certificates to the ssl.com/repository.
- SSL.com’s auditors confirmed the finding would be handled as an incident in the audit reports.
- SSL.com — SSL.com filed a preliminary incident report describing that six Root CA certificates were listed in the CP/CPS but were not published in the repository.
- SSL.com — SSL.com posted the full incident report and attached an appendix CSV.
- SSL.com — SSL.com said Action Item #3 remains ongoing and requested the next update be set to 2026-10-23.