TrustAsia third-party reported CAA mis-issuance incident
TrustAsia opened this case after receiving a third-party Certificate Problem Report on 2026-10-16 alleging that it had issued certificates for domains whose CAA records prohibited issuance by TrustAsia. TrustAsia said its initial investigation confirmed the affected certificates were DV certificates issued using DNS-based domain validation. The company reported that, under certain conditions, its issuance workflow incorrectly reused CAA lookup results from a parent domain when processing subdomains, so the CAA check for the subdomain was not performed correctly. TrustAsia said it immediately suspended DNS-based domain validation issuance, then resumed after fixing the defect and verifying the remediation in production. It also stated that the affected certificate list contained 19,237 certificate records and that the corresponding certificates had all been revoked. TrustAsia said it would publish a Full Incident Report within 14 days of the preliminary report.
- TrustAsia received a third-party report alleging issuance despite CAA records prohibiting TrustAsia.
- TrustAsia published a preliminary incident report describing the CAA lookup defect, suspension of DNS-based DV issuance, remediation, and revocation of affected certificates.
- TrustAsia Technologies, Inc. — TrustAsia filed a preliminary incident report describing the third-party-reported CAA mis-issuance, the remediation steps taken, and the plan to publish a full incident report within 14 days.