CA/PKI Weekly Digest - Oct 5 - Oct 12, 2026

Let's Encrypt announced that from February 10, 2027 its certificates will last 64 days by default instead of 90 (announcement). The last 90-day certificate is expected to expire on May 11, 2027, and no certificate will be revoked because of the change. In 2028 the default drops again, to 45 days.

Shorter lifetimes mean more renewals, and more chances for one to fail quietly. TLS Radar watches the expiry date of every certificate you monitor and emails you before it runs out.

DigiCert reported that three issuing CAs it runs for Amazon were created in 2024 but never added to its own inventory, so they were missing from the public CA database and from two years of audits (bug 2075949). Amazon revoked all three on September 29 and replaced the 11,852 certificates they had issued. TLS Radar checks every certificate in your chain against the list of revoked intermediates. These three are on it, so a site still serving one would be flagged.

GoDaddy issued 54 certificates for a private key that had already been reported as compromised (bug 2079943). It has revoked them. When a certificate is revoked for key compromise, reissuing is not enough: you need a new private key. TLS Radar's revocation monitoring* tells you when a certificate is revoked and why.

SwissSign finished its report on backdated certificates (bug 2074466). It found two. One was backdated by 48 hours and 38 minutes and revoked one second after it was issued. The other, from February 2024, was backdated by 17 days and was only found now, after it had already expired. TLS Radar now warns you when a certificate's start date is more than 48 hours before it was publicly logged.

Sectigo and DigiCert both received reports of certificates issued for domains owned by sanctioned entities, and have already revoked or are revoking them (bug 2077538, bug 2078824).

Several CAs published revocation lists late. Telekom Security issued no new lists for three of its CAs for more than four days at a time (bug 2077068). Two of Sectigo's lists expired before new ones were signed (bug 2078220). Actalis listed three revocations 56 days after they happened (bug 2077464). DigiCert is closing its expired-list incident from September, and a commenter pointed out that it promised the same monitoring after two earlier incidents (bug 2072906). TLS Radar flags an expired revocation list when your certificate points to it.

The reports of badly formatted revocation data moved on from lists to OCSP, the service that answers "is this certificate revoked?" one certificate at a time. SwissSign, Kamu SM, NAVER, TWCA and Beijing CA all reported formatting or timing errors within three days (bug 2079641, bug 2080195, bug 2080229, bug 2080273, bug 2080411). Apple found that one of its lists had been signed with the wrong algorithm since August 2020 (bug 2076246). These break the rules, but none was reported to stop revocation checks from working.

Two stories from earlier weeks are still open. Firmaprofesional has not yet revoked its old SHA-1 intermediate, missed its own October 9 planning date, and found the same CA had been left out of its audits (bug 2072600, bug 2077459). Sectigo is still not revoking the certificates covered by its disputed wording: 81.7 million were active on October 8 (bug 2069640).

* Revocation monitoring is available on Business and Enterprise plans

A weekly summary of certificate authority incidents and compliance activity, sourced from Mozilla's public CA Program tracker.

New this week

• GoDaddy: Certificate Issuance Using Previously Compromised Private Key - source
• Asseco DS / Certum: Incorrect AlgorithmIdentifier Encoding in OCSP responses - source
• Actalis: Non-compliant OCSP responses and OCSP responder certificate - source
• Sectigo: Legacy Subordinate CA Certificate without digitalSignature KU signing OCSP responses - source
• ACCV: OCSP responses include “archiveCutoff” in “responseExtensions” - source
• CFCA: Certificates Issued with lower case value in subject:countryName - source
• eMudhra emSign PKI Services: Delegated OCSP Responder certificates containing cRLDistributionPoints extension - source
• Telekom Security: OCSP responder uses incorrect signature algorithm for P-384 signing key - source
• Certigna: Failure to announce completion of action item within prescribed time period - source
• iTrusChina: OCSP Response ECDSA signatureAlgorithm with NULL parameters - source
• NAVER Cloud Trust Services: OCSP responses with an empty responseExtensions - source
• Kamu SM: Non-BR-Compliant OCSP Response Validity Interval - source
• TWCA: Non-critical basicConstraints in Delegated OCSP Responder Certificates - source
• BEIJING CERTIFICATE AUTHORITY Co., Ltd.: OCSP responses with an empty singleExtensions - source
• SwissSign: Incorrectly encoded OCSP extension - source
• SwissSign: Root CRLs Missing Reason Code - source
• DigiCert: Certificates issued for sanctioned entities - source

Updates on open incidents

• Sectigo: No revocation after CP/CPS language involving extendedKeyUsage found to be subject to multiple interpretations - source
• ACCV: Delayed revocation related to Bugzilla #2061746 - source
• IdenTrust: Expired certificates for "Revoked" test websites - source
• IZENPE: revocation reason code not included in CRL issued by Root - source
• FNMT: Delayed Revocation of SHA-1 Signed Subordinate CA Certificate - source
• Actalis: Incorrect Revocation dates in CRL entries - source
• Actalis: Root CA CRL not published within 24 hours after recording revocations - source
• Firmaprofesional: Delayed revocation of SHA-1-signed AC Firmaprofesional - CA1 - source
• Microsec: Insufficent support for "unspecified (0)" revocation reason - source
• DigiCert: Revocation of Undisclosed Issuing CAs - source
• DigiCert: Revocation of SHA1 Issuing CAs - source
• SwissSign: Delayed revocation related to Bugzilla 2033000 - source
• D-Trust: Missing Pre-Signing Linting for TLS Issuance - source
• D-Trust: Missing Pre-Sign Linting for S/MIME Issuing CAs - source
• Firmaprofesional: Chrome Root Progam Policy - Dedicated TLS hierarchy / EKU requirements - source
• Asseco DS / Certum: Multi-purpose Subordinate CA with missing EKU - source
• D-Trust: Incorrect CPS URLs in CCADB for six S/MIME CA certificate records - source
• CFCA: Incorrect countryName values in OV subscriber certificates - source
• iTrusChina: Reusing CRLnumber and Missing NULL Parameter of CRL signatureAlgorithm - source
• ACCV: Issuance of Server TLS Certificates with CP/CPS Discrepancies - source
• Certigna: CRL HTTP Media Type - source
• Sectigo: Submitted CPR not replied to within 24 hours - source
• SHECA: CP/CPS lacks explicit adherence statement - source
• SHECA: ECC CRL/OCSP Signature Algorithm Issue - source
• Firmaprofesional: AC Firmaprofesional - CA1 excluded from audit scope - source
• NAVER Cloud Trust Services: Missing CRL disclosure for two subordinate CAs in CCADB - source
• Firmaprofesional: Delayed preliminary CPR response due to incomplete mailbox monitoring coverage - source
• NETLOCK: Failure to Respond to a Certificate Problem Report Within 24 Hours - source
• NETLOCK: Failure to file a preliminary incident report within 72 hours (OCSP responder incident, Bug 2051459) - source
• Asseco DS / Certum: EV TLS Certificate Issued with Branch Name as Subject Organization Name - source
• Asseco DS / Certum: CRL URLs in issued certificates not disclosed in CCADB - source
• Asseco DS / Certum: Incorrect ECDSA-SHA384 AlgorithmIdentifier Encoding in CRLs - source
• Sectigo: CP/CPS language involving extendedKeyUsage found to be subject to multiple interpretations - source
• NETLOCK: Certificate Problem Report [CRL RFC 5280 S5.2.3] - source
• NETLOCK: Certificate Problem Report [CRL URL not disclosed in CCADB] - source
• NETLOCK: Certificate Problem Report [CRL BR S7.2.2] - source
• TunTrust: CP/CPS markdown version missing root program attestation - source
• SHECA: Incorrect Disclosure of Partitioned CRLs in CCADB - source
• DigiCert: Expired CRL - source
• Netlock: CA in AIA in PEM format - source
• NETLOCK: OCSP Service Returning Error for Issued Certificate - source
• SSL.com: MPIC not performed for specific DCV path - source
• SSL.com: CRL URL typo in CRL URL disclosed to CCADB - source
• FNMT: Issuance of intermediates after 2019-01-01 that do not comply with Mozilla Policy - source
• Apple: CRL is signed incorrectly - source
• Disig: CRL contains not allowed attributes - source
• PKIoverheid: TSP KPN Delayed publication of audit attestation letters in the CCADB - source
• Firmaprofesional: OCSP signature verification errors for Secure Web 2024 certificates - source
• eMudhra emSign PKI Services: InCommon RSA IGTF Server CA 4 — certificates issued with key sizes not permitted by CPS - source
• eMudhra emSign PKI Services: InCommon IGTF SSL CPS missing conformance statement for Baseline Requirements - source
• Telia: CRL signature algorithm property non-conformance for EC issuer key - source
• Chunghwa Telcom: Delay of 2025 WebTrust for CA Audit Reports seals for ePKI & HiPKI - source
• SwissSign - Backdating of 48+h - source
• Hongkong Post: CRL HTTP endpoints returned legacy media type application/x-pkcs7-crl - source
• DigiCert: EV JOI match with organizationIdentifer - source
• Telekom Security: Failure to respond to a certificate problem report within 24 hours - source
• SSL.com: Failure to Post all Root and Intermediate CA certificates in Repository identified in CP/CPS - source
• Actalis: Issuance of Server TLS Certificates with id-kp-clientAuth against CPS - source
• Actalis: Incorrect CRL Distribution Point in TLS Server Certificates - source
• Actalis: Undisclosed Subordinate CA Certificate - source
• KIR: SZAFIR ROOT CA3 TLS CRL nextUpdate exceeds 12 months - source
• Telekom Security: Failure in automatic issuance of CRLs - source
• SECOM: Missing Prior Notification and Approval for a Cross-Certificate Extending Trust to Externally-Operated JPRS CAs - source
• Let's Encrypt: Root CRLs Missing Reason Code - source
• Telekom Security / DFN: crlEntryExtensions SEQUENCE of size 0 - source
• D-TRUST: Incomplete Disclosure of CRL URLs - source
• Sectigo: Violation of TLS BR 7.1.3.2.2 in OCSP responses - source
• Kamu SM: Missing CRL Disclosure for Cross-Signed CA in CCADB - source
• GlobalSign: StateOrProvince and LocalityName value inconsistency - source
• Firmaprofesional: certificateHold reasonCode entries in AC Firmaprofesional - CUALIFICADOS CRL - source
• SSL.com: Inconsistent published CRL for one ICA - source
• Sectigo: Certificates issued for sanctioned entities - source
• Sectigo: Failure to announce completion of action item within prescribed time period - source
• Sectigo: Signing infrastructure migration disrupted issuance of 2 CRLs - source

Resolved this week

• Let's Encrypt: CRLs Temporarily Missing Revoked Serials - source
• Firmaprofesional: CP/CPS missing Chrome Root Program and CCADB policy attestation - source
• SHECA: Failed to provide a preliminary incident report within 72 hours - source
• eMudhra emSign PKI Services: Test Website TLS Certificates Issued Against CP/CPS. - source
• Microsoft PKI Services: Third-Party Code Signing CPS missed annual update and four Issuing CAs - source
• Microsoft PKI Services: Missed Seven-Day Update for Bugzilla 2059818 - source
• Actalis: failure to timely update CP/CPS for AgID SubCAs - source