Skip to main content

CA/PKI Weekly Digest - Sep 28 - Oct 5, 2026

Stay alert of the changes for your SSL/TLS cert

TLS Radar continuously monitors every certificate across your domains and alerts you weeks before anything expires, and also catches the silent failure modes - chain breaks, weak ciphers, hostname mismatches, risky EKUs, and distrust events - that keep a site from opening in every browser. Built for solo developers monitoring a handful of sites and for enterprise teams managing thousands of certificates across multiple environments.

Sign Up Talk to us about enterprise solutions

A weekly summary of certificate authority incidents and compliance activity, sourced from Mozilla's public CA Program tracker.

New this week

  • IZENPE: revocation reason code not included in CRL issued by Root - source
  • Actalis: Root CA CRL not published within 24 hours after recording revocations - source
  • Chunghwa Telecom:Finding in 2025 WebTrust for CA-BR and fixed in bug #2012274 (Issuance of certificate using keys previously reported as compromised) [RESOLVED] - source
  • Sectigo: Signing infrastructure migration disrupted issuance of 2 CRLs - source
  • GoDaddy: Delayed CRL Updates - source
  • SSL.com: Inconsistent published CRL for one ICA - source
  • Sectigo: Certificates issued for sanctioned entities - source
  • Sectigo: Failure to announce completion of action item within prescribed time period - source
  • Firmaprofesional: AC Firmaprofesional - CA1 excluded from audit scope - source
  • Certigna: CRL HTTP Media Type - source
  • Apple: CRL is signed incorrectly - source
  • D-Trust: Incorrect CPS URLs in CCADB for six S/MIME CA certificate records - source
  • Hongkong Post: CRL HTTP endpoints returned legacy media type application/x-pkcs7-crl - source
  • Telekom Security: Failure in automatic issuance of CRLs - source
  • SHECA: Incorrect Disclosure of Partitioned CRLs in CCADB - source
  • iTrusChina: Reusing CRLnumber and Missing NULL Parameter of CRL signatureAlgorithm - source
  • SSL.com: CRL URL typo in CRL URL disclosed to CCADB - source

Updates on open incidents

  • DigiCert: Revocation of SHA1 Issuing CAs - source
  • SwissSign: Delayed revocation related to Bugzilla 2033000 - source
  • ACCV: Delayed revocation related to Bugzilla #2061746 - source
  • GoDaddy: Delayed Revocation of SHA-1 Signed Subordinate CA Certificates - source
  • Actalis: Incorrect Revocation dates in CRL entries - source
  • IdenTrust: Expired certificates for "Revoked" test websites - source
  • Let's Encrypt: CRLs Temporarily Missing Revoked Serials - source
  • Sectigo: No revocation after CP/CPS language involving extendedKeyUsage found to be subject to multiple interpretations - source
  • DigiCert: Revocation of Undisclosed Issuing CAs - source
  • Firmaprofesional: Delayed revocation of SHA-1-signed AC Firmaprofesional - CA1 - source
  • Microsec: Insufficent support for "unspecified (0)" revocation reason - source
  • FNMT: Delayed Revocation of SHA-1 Signed Subordinate CA Certificate - source
  • Sectigo: Submitted CPR not replied to within 24 hours - source
  • SHECA: ECC CRL/OCSP Signature Algorithm Issue - source
  • SHECA: CP/CPS lacks explicit adherence statement - source
  • SHECA: Failed to provide a preliminary incident report within 72 hours - source
  • Firmaprofesional: certificateHold reasonCode entries in AC Firmaprofesional - CUALIFICADOS CRL - source
  • GlobalSign: StateOrProvince and LocalityName value inconsistency - source
  • Kamu SM: Missing CRL Disclosure for Cross-Signed CA in CCADB - source
  • ACCV: Issuance of Server TLS Certificates with CP/CPS Discrepancies - source
  • DigiCert: EV JOI match with organizationIdentifer - source
  • NETLOCK: Certificate Problem Report [CRL RFC 5280 S5.2.3] - source
  • GoDaddy: CCADB Missing Partitioned CRL URL Disclosure - source
  • SSL.com: MPIC not performed for specific DCV path - source
  • HARICA: Issuance of Server TLS Certificates with id-kp-clientAuth KeyPurposeID against CP/CPS - source
  • Disig: CRL contains not allowed attributes - source
  • eMudhra emSign PKI Services: InCommon RSA IGTF Server CA 4 — certificates issued with key sizes not permitted by CPS - source
  • FNMT: Issuance of intermediates after 2019-01-01 that do not comply with Mozilla Policy - source
  • Firmaprofesional: Delayed preliminary CPR response due to incomplete mailbox monitoring coverage - source
  • Firmaprofesional: CP/CPS missing Chrome Root Program and CCADB policy attestation - source
  • D-TRUST: Incomplete Disclosure of CRL URLs - source
  • D-Trust: Delayed publication of audit attestation letters in the CCADB - source
  • Asseco DS / Certum: EV TLS Certificate Issued with Branch Name as Subject Organization Name - source
  • Netlock: CA in AIA in PEM format - source
  • Telia: CRL signature algorithm property non-conformance for EC issuer key - source
  • NETLOCK: Certificate Problem Report [CRL URL not disclosed in CCADB] - source
  • NETLOCK: Certificate Problem Report [CRL BR S7.2.2] - source
  • NETLOCK: Failure to Respond to a Certificate Problem Report Within 24 Hours - source
  • NETLOCK: OCSP Service Returning Error for Issued Certificate - source
  • NETLOCK: Failure to file a preliminary incident report within 72 hours (OCSP responder incident, Bug 2051459) - source
  • SSL.com: Delayed disclosure of Timestamping CA in CCADB - source
  • Sectigo: CP/CPS language involving extendedKeyUsage found to be subject to multiple interpretations - source
  • SwissSign - Backdating of 48+h - source
  • eMudhra emSign PKI Services: InCommon IGTF SSL CPS missing conformance statement for Baseline Requirements - source
  • Telekom Security: Failure to respond to a certificate problem report within 24 hours - source
  • Telekom Security / DFN: crlEntryExtensions SEQUENCE of size 0 - source
  • Sectigo: Violation of TLS BR 7.1.3.2.2 in OCSP responses - source
  • DigiCert: OCSP returns unauthorized for an issued TLS Certificate - source
  • Actalis: Incorrect CRL Distribution Point in TLS Server Certificates - source
  • Actalis: Issuance of Server TLS Certificates with id-kp-clientAuth against CPS - source
  • Actalis: Undisclosed Subordinate CA Certificate - source
  • eMudhra emSign PKI Services: Test Website TLS Certificates Issued Against CP/CPS. - source
  • DigiCert: Expired CRL - source
  • CFCA: Incorrect countryName values in OV subscriber certificates - source
  • Firmaprofesional: Chrome Root Progam Policy - Dedicated TLS hierarchy / EKU requirements - source
  • D-Trust: Missing Pre-Signing Linting for TLS Issuance - source
  • D-Trust: Missing Pre-Sign Linting for S/MIME Issuing CAs - source
  • TunTrust: CP/CPS markdown version missing root program attestation - source
  • SECOM: Missing Prior Notification and Approval for a Cross-Certificate Extending Trust to Externally-Operated JPRS CAs - source
  • Chunghwa Telcom: Delay of 2025 WebTrust for CA Audit Reports seals for ePKI & HiPKI - source
  • NAVER Cloud Trust Services: Missing CRL disclosure for two subordinate CAs in CCADB - source

Check your certificate now

See whether any of this week's CA incidents affect a certificate you're running - free, no account required.

Scan my domain

Resolved this week

  • Chunghwa Telecom: Issuance of certificate using keys previously reported as compromised - source
  • SwissSign: Delayed revocation in Bug 2057448 - source
  • Amazon Trust Services: CP/CPS for externally operated subordinate CAs not updated in CCADB within 14 days - source
  • SECOM: Five Subordinate CA Certificates Issued Without Apple Prior Approval for Cybertrust Japan (CTJ) - source
  • SHECA: Disclosure alerts indicating audit information missing for 2 Sub-CAs - source
  • IdenTrust: Delayed disclosure of Intermediate CA in CCADB - source
  • CFCA: Cross-signed certificate missing the Extended Key Usage (EKU) extension - source
  • Exploring the interaction between descriptive and normative language in CP/CPS documents and the potential for confusion - source
  • Asseco DS / Certum: Incorrect Country in certificate - source
  • SwissSign: Invalid Entry in State field - source
  • Sectigo: jurisdictionCountry versus organizationIdentifier mismatch in QWAC - source
  • Sectigo: Issuance of certificates including a Subject:countryName not corresponding to a Country - source
  • Disig: Multi-purpose Subordinate CA with missing EKU - source
  • iTrusChina: Inconsistent EKUs in CP/CPS and Mis-issuance of TLS Certificates with clientAuth against CP/CPS - source

Get this digest in your inbox

Subscribe to receive this digest by email.