Actalis: Root CA CRLs were not republished within 24 hours after SubCA revocations
Actalis reported that its Root CA CRLs were not regenerated and published within the required 24 hours after several SubCA revocations. The issue involved three TLS SubCA certificates and one S/MIME SubCA certificate that were revoked on 2026-08-04 after internal verification procedures detected technical defects. The corresponding CRLs were not updated until the scheduled quarterly publication on 2026-09-29, about 56 days later. Actalis said the problem was identified first by an external report for the TLS case and then by internal checks for the S/MIME case. The bug remains assigned, and the thread indicates Actalis provided a preliminary incident report, a weekly update, and then a full incident report describing the non-compliance and its timeline.
- Actalis revoked three TLS SubCA certificates and one S/MIME SubCA certificate after internal verification procedures detected technical defects.
- The 24-hour CRL publication deadlines elapsed without the corresponding Root CA CRLs being regenerated and published.
- Actalis published CRL number 7 for the TLS and S/MIME roots, including the revocation entries.
- Actalis received an external report about the delayed CRL publication for the TLS root.
- Staff representative — Actalis filed a preliminary incident report saying an external report had identified delayed publication of revocation information in the CRL and that a full incident report would follow.
- Staff representative — Actalis said it was continuing its internal investigation and would publish the full incident report within the required timeframe.
- Staff representative — Actalis filed the full incident report explaining that the CRLs were not regenerated and published within 24 hours after the revocations.