ACCV EKU inconsistency in RSA1 TLS subordinate CA certificates reported by Chrome Root Program
This case reports a non-compliance found by the Chrome Root Program during its review of ACCV’s new root inclusion request. Chrome identified that two unexpired, unrevoked ACCV RSA1 TLS subordinate CA certificates share the same public key but assert different EKU values. ACCV says it was notified by Chrome on 2026-10-13 and accepts Chrome’s interpretation that active subordinate CA certificates sharing a public key must have identical EKU values, even when one EKU set is a subset of the other. ACCV states the incident is not yet contained because the 2024 dual-EKU certificate remains unrevoked. ACCV also said it will provide a full incident report by 2026-10-30 and will keep the bug updated at least weekly or when new information becomes available.
- ACCV issued a subordinate CA certificate asserting serverAuth and clientAuth EKUs.
- ACCV issued a cross-certificate for the same public key asserting only serverAuth EKU.
- Chrome Root Program notified ACCV of the EKU non-compliance.
- Chrome clarified that active subordinate CA certificates sharing a public key must have identical EKU values.
- ACCV opened this incident report in Mozilla Bugzilla.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — ACCV reported the EKU inconsistency, said the issue was discovered by Chrome during root inclusion review, and committed to a full incident report by 2026-10-30.