D-TRUST reported CPR about TSPS v3.1 CA key-size wording; CA requests invalid closure
D-TRUST opened this bug after receiving an external Certificate Problem Report on 2026-10-14 questioning the CA key-size wording in its TSPS v3.1. The report argued that the TSPS minimum of 3072 bits for RSA CA keys was insufficient for publicly trusted S/MIME CA certificates, which the reporter said require 4096 bits under the S/MIME Baseline Requirements. D-Trust stated that the TSPS wording is a shared minimum for multiple services, that the applicable S/MIME requirements are stricter, and that its CPS gives those requirements priority where applicable. The company said no undersized key was used in a CA certificate and asked for the bug to be closed as INVALID. CCADB said it would accept comments through 2026-10-27 and then close the bug as INVALID unless there were objections.
- An external CPR questioned D-Trust's TSPS v3.1 CA key-size provisions for publicly trusted S/MIME CA certificates.
- D-Trust released TSPS version 3.1.
- TSPS version 3.1 became effective.
- D-Trust — D-Trust filed a preliminary incident report, explained why it считает the CPR allegation incorrect, and requested that the bug be closed as INVALID.
- CCADB representative — CCADB said it would accept comments through 2026-10-27 and then close the bug as INVALID unless there were comments in opposition.