DigiCert: undisclosed issuing CAs omitted from CCADB and WebTrust audit scope

This case concerns three DigiCert-operated TLS Issuing CAs that were signed in 2024 but were not registered in DigiCert's internal CA disclosure system, PrimaRoot. As a result, the CAs were absent from CCADB and from DigiCert's WebTrust reports from 2024 onward. DigiCert states that this was a disclosure and audit-scope failure, not a certificate misissuance issue. The problem was first reported by a third party to Amazon, then relayed to DigiCert. DigiCert confirmed the omission, filed a preliminary incident report, and revoked the three Issuing CAs on 2026-09-29. DigiCert later said it completed PrimaRoot reconciliation and revised its key ceremony process to ensure registration in PrimaRoot.

1. 2024-11-14 Three DigiCert-operated TLS Issuing CAs were signed during key ceremony KC-850 but were not registered in PrimaRoot.
2. 2024-11-14 The CAs were omitted from DigiCert's CCADB disclosures and WebTrust audit population.
3. 2026-09-25 A third party reported that the three CAs were absent from DigiCert's WebTrust audit report.
4. 2026-09-29 The three Issuing CAs were revoked.
5. 2026-10-15 DigiCert said it completed PrimaRoot reconciliation and revised the key ceremony process to ensure PrimaRoot registration.

1. 2026-09-27 DigiCert — DigiCert filed a preliminary incident report saying a third party had reported the omission and that the three issuing CAs would be revoked by 2026-10-01.
2. 2026-09-30 DigiCert — DigiCert said the three issuing CAs had been revoked and that a full incident report would follow.
3. 2026-10-06 DigiCert — DigiCert's full incident report said the issue was incomplete disclosure and audit scope, with no certificate misissuance, and that all three CA certificates were revoked on 2026-09-29.
4. 2026-10-07 DigiCert — DigiCert requested a next update date for action items 3 and 5.
5. 2026-10-12 Community commenter — A commenter asked DigiCert to clarify the revocation date and expand the incident timeline.
6. 2026-10-15 DigiCert — DigiCert said it completed action item #3 (PrimaRoot reconciliation) and action item #5 (key ceremony revision to ensure registration in PrimaRoot).
7. 2026-10-19 DigiCert — DigiCert reiterated that the incident involved incomplete disclosure and audit, not improper operation of the CAs or their key material.