Amazon Trust Services incident report: EV trust bit enabled without required EV test websites
Amazon Trust Services reported that its EV trust bit remained enabled for five roots even though it did not host EV test websites as required by Appendix A of the EV Guidelines. ATS said it last issued an EV certificate in 2019 and has not issued EV certificates since then, and that the certificates shown on the disclosed test pages were not EV certificates. The issue was identified on 2026-10-12 after a third party reported the missing EV test websites, and ATS confirmed the finding the same day. ATS said it notified the root programs and requested removal of the EV trust bit for all five roots. The report states that the action items were completed and ATS requested closure. The bug remains open pending final closure by the incident-reporting process.
- ATS stopped issuing EV certificates and removed EV certificates from the test website.
- A third party reported that ATS was not hosting EV test websites as required by EV Guidelines Appendix A.
- ATS confirmed the finding and notified the root programs.
- ATS requested removal of the EV trust bit for all five affected roots.
- The incident-reporting process indicated the report would be closed if no further comments were received.
- DigiCert — ATS filed an incident report describing the missing EV test websites, the root cause, and completed action items.
- DigiCert — ATS posted a closure summary requesting closure after requesting retirement of the EV trust bit and reviewing the EV guidelines.
- CCADB representative — CCADB issued a final call for comments and said the report would be closed on approximately 2026-10-22.