Skip to main content

CA/PKI Weekly Digest - Sep 7 - Sep 14, 2026

Stay alert of the changes for your SSL/TLS cert

TLS Radar continuously monitors every certificate across your domains and alerts you weeks before anything expires, and also catches the silent failure modes - chain breaks, weak ciphers, hostname mismatches, risky EKUs, and distrust events - that keep a site from opening in every browser. Built for solo developers monitoring a handful of sites and for enterprise teams managing thousands of certificates across multiple environments.

Sign Up Talk to us about enterprise solutions

A weekly summary of certificate authority incidents and compliance activity, sourced from Mozilla's public CA Program tracker.

New this week

  • Firmaprofesional: OCSP signature verification errors for Secure Web 2024 certificates - source
  • Firmaprofesional: Delayed preliminary CPR response due to incomplete mailbox monitoring coverage - source
  • DigiCert: OCSP returns unauthorized for an issued TLS Certificate - source
  • SSL.com: MPIC not performed for specific DCV path - source
  • Asseco DS / Certum: EV TLS Certificate Issued with Branch Name as Subject Organization Name - source
  • Sectigo: Issuance of certificates including a Subject:countryName not corresponding to a Country - source

Updates on open incidents

  • IdenTrust: Expired certificates for "Revoked" test websites - source
  • Sectigo: No revocation after CP/CPS language involving extendedKeyUsage found to be subject to multiple interpretations - source
  • Microsec: Insufficent support for "unspecified (0)" revocation reason - source
  • ACCV: Delayed revocation related to Bugzilla #2061746 - source
  • Let's Encrypt: CRLs Temporarily Missing Revoked Serials - source
  • Firmaprofesional: CP/CPS missing Chrome Root Program and CCADB policy attestation - source
  • GlobalSign: StateOrProvince and LocalityName value inconsistency - source
  • DigiCert: CPR subject.countryName - source
  • CFCA: Cross-signed certificate missing the Extended Key Usage (EKU) extension - source
  • iTrusChina: Inconsistent EKUs in CP/CPS and Mis-issuance of TLS Certificates with clientAuth against CP/CPS - source
  • TWCA: CPR subject.countryName - source
  • SECOM: Inaccurate CP/CPS description regarding the basicConstraints extension of OCSP responder certificates by Cybertrust Japan (CTJ) - source
  • Amazon Trust Services: CP/CPS missing explicit adherence to latest version of policies - source
  • SHECA: Disclosure alerts indicating audit information missing for 2 Sub-CAs - source
  • SHECA: Failed to provide a preliminary incident report within 72 hours - source
  • CFCA: Delayed response to CPR related with bug 2058918 - source
  • CFCA: Incorrect countryName values in OV subscriber certificates - source
  • SSL.com: Invalid combinations of countryName, stateOrProvinceName, and localityName attributes - source
  • GoDaddy: CCADB Missing Partitioned CRL URL Disclosure - source
  • Chunghwa Telcom: Delay of 2025 WebTrust for CA Audit Reports seals for ePKI & HiPKI - source
  • Asseco DS / Certum: Incorrect Country in certificate - source
  • SECOM: Five Subordinate CA Certificates Issued Without Apple Prior Approval for Cybertrust Japan (CTJ) - source
  • SSL.com: Delayed disclosure of Timestamping CA in CCADB - source
  • Exploring the interaction between descriptive and normative language in CP/CPS documents and the potential for confusion - source
  • Microsoft PKI Services: Third-Party Code Signing CPS missed annual update and four Issuing CAs - source
  • Actalis: Incorrect CRL Distribution Point in TLS Server Certificates - source
  • Sectigo: CP/CPS language involving extendedKeyUsage found to be subject to multiple interpretations - source
  • Firmaprofesional: Chrome Root Progam Policy - Dedicated TLS hierarchy / EKU requirements - source
  • eMudhra emSign PKI Services: Test Website TLS Certificates Issued Against CP/CPS. - source
  • SECOM: Missing Prior Notification and Approval for a Cross-Certificate Extending Trust to Externally-Operated JPRS CAs - source
  • ACCV: Issuance of Server TLS Certificates with CP/CPS Discrepancies - source
  • Actalis: Undisclosed Subordinate CA Certificate - source
  • Actalis: failure to timely update CP/CPS for AgID SubCAs - source
  • Actalis: Issuance of Server TLS Certificates with id-kp-clientAuth against CPS - source
  • DigiCert: jurisdictionCountry in EV certificate - source
  • Let's Encrypt: CPS missing root program attestation - source
  • IdenTrust: 2026 Audit Report Finding - source
  • Sectigo: jurisdictionCountry versus organizationIdentifier mismatch in QWAC - source
  • SwissSign: Invalid Entry in State field - source

Check your certificate now

See whether any of this week's CA incidents affect a certificate you're running - free, no account required.

Scan my domain

Resolved this week

  • SDAIA: Delayed Revocation related to Bugzilla #2056942 - source
  • Disig: CP/CPS misstatement regarding Key Usage criticality for TLS certificates - source
  • eMudhra emSign PKI Services: www Subdomain Inclusion in Certificate SAN via ACME Issuance Workflow - source
  • GlobalSign: Unicode replacement character issue in Subject - source
  • eMudhra emSign PKI Services: Invalid Subject Locality/State Values - source
  • Asseco DS / Certum: Delayed publication of Full Incident Report for Bug 2055775 - source
  • Asseco DS / Certum: Incomplete CRL Disclosure in CCADB - source
  • Certainly: Test Website Certificate Renewal Failure Following Production Deployment Drift - source
  • Firmaprofesional: Delayed publication of 2026 Audit Attestation Letters - source

Get this digest in your inbox

Subscribe to receive this digest by email.