KIR issued TLS certificates from legacy SZAFIR Trusted CA6 after committing to use the TLS-dedicated hierarchy
KIR reported that it issued three TLS server authentication certificates for its own domains from the legacy SZAFIR Trusted CA6 hierarchy after it had committed to issue new TLS certificates only from the SZAFIR ROOT CA3 TLS hierarchy. The incident was first reported by the Chrome Root Program in CCADB Case 00003256, and KIR then filed a preliminary incident report followed by a full incident report. KIR said the affected certificates were replaced and revoked, and that TLS issuance from SZAFIR Trusted CA6 was technically disabled on 14 October 2026. KIR also stated that no external subscribers were affected and that no other TLS certificates were found in a review of CA6 issuance after 12 August 2026. The thread says the non-compliance was the use of a hierarchy KIR had committed to stop using for TLS issuance, not a revocation delay.
- KIR committed in CCADB Case 00003256 to transition TLS issuance to SZAFIR ROOT CA3 TLS and cease TLS issuance from the legacy hierarchy once the new hierarchy began.
- TLS issuance from the SZAFIR ROOT CA3 TLS hierarchy began.
- KIR issued the first affected TLS server certificate from SZAFIR Trusted CA6.
- KIR issued two more affected TLS server certificates from SZAFIR Trusted CA6.
- TLS issuance from SZAFIR Trusted CA6 was technically disabled.
- The affected certificates began being revoked.
- Kir representative — KIR filed a preliminary incident report describing three TLS certificates issued from the legacy hierarchy after its commitment to use only SZAFIR ROOT CA3 TLS.
- Kir representative — KIR filed the full incident report, stating the certificates were replaced and revoked and that the non-compliance was issuing TLS certificates from the legacy hierarchy after the Chrome deadline.