Firmaprofesional audit scope exclusion for AC Firmaprofesional - CA1
Firmaprofesional reported that AC Firmaprofesional - CA1 was excluded from the scope of referenced Standard and TLS BR audits and therefore absent from the corresponding audit statements. The issue was first identified after a Certificate Problem Report on 2026-09-15 noted both CA1's SHA-1 signature and its absence from the audit statements. Firmaprofesional said it had treated the service's Withdrawn status in the Spanish Trusted List as a basis for excluding CA1, but later acknowledged that Trusted List status and publicly trusted CA certificate requirements are distinct. The company stated that CA1 is the only confirmed certificate excluded on this basis, that the incident remains open, and that historical audit coverage review and corrective assessment are still in progress. In the full incident report, Firmaprofesional said the chosen corrective measure is revocation of CA1, and that the case will remain open until the stated measures are carried out. A separate bug tracks the delayed SHA-1 revocation issue.
- The first subsequent audit period began, and published auditor attestations did not list CA1.
- A Certificate Problem Report identified CA1's SHA-1 signature and its absence from the referenced audit statements.
- The Root Program requested a separate public report for the audit issue.
- Firmaprofesional filed the full incident report and said CA1 was the only confirmed audit-scope exclusion.
- Autoridad de Certificacion Firmaprofesional — Filed a preliminary incident report explaining that CA1 was omitted from audit scope and that the review and corrective assessment were still ongoing.
- Autoridad de Certificacion Firmaprofesional — Provided a status update saying CA1 remained the only confirmed excluded certificate and asked for the next update date to be set to 2026-10-16.
- CCADB representative — Noted that Oct. 16 was less than seven days away and left the bug without a Next Update whiteboard label.
- Autoridad de Certificacion Firmaprofesional — Submitted the full incident report, stating that CA1 was excluded from audit scope and that the incident remains open until the stated measures are carried out.