CA/PKI Weekly Digest - Oct 12 - Oct 19, 2026

GoDaddy is revoking 404,607 certificates (bug 2082703). Someone outside the company found that the policy fields inside certificates from several GoDaddy and Starfield intermediates did not match what GoDaddy's own published rules say they contain. Almost all of them, 396,055, are basic DV certificates from Starfield. The rules give a CA five days to revoke certificates like these. GoDaddy started contacting customers on October 14, said it would not finish by the October 18 deadline, and opened a second report for the delay (bug 2083191). It promised an update on October 19. If GoDaddy has emailed you about this, replace the certificate before it is revoked. TLS Radar's revocation monitoring* tells you when a certificate you monitor has been revoked.

Let's Encrypt switched its staging environment to 64-day certificates on October 14, four months before the change reaches real certificates on February 10, 2027 (announcement). If you want to know whether your renewal setup copes with the shorter lifetime, staging is the place to find out. Let's Encrypt is also adding two more places that check your domain before a certificate is issued, so each check will run from seven places instead of five: in staging from October 27 and in production from November 10 (announcement). The industry rules require this from December 15. Let's Encrypt expects little to no impact.

Eight more CAs reported mistakes in their OCSP responses, or in the certificates that sign them: iTrusChina, Telekom Security, eMudhra, ACCV, Sectigo, Actalis, Certum and ANF (bug 2080679, bug 2080708, bug 2080742, bug 2080796, bug 2080798, bug 2080806, bug 2080819, bug 2081189). Most were reported to the CAs on October 9. The errors are in how the answers are encoded, such as a few bytes missing from or added to the name of the signature algorithm, or an extension in the wrong place. As last week, none was reported to stop revocation checks from working.

A CA that issues EV certificates must run public test pages with a valid, a revoked and an expired EV certificate, so that browser makers can test against them. Six CAs reported problems with these pages this week: Amazon, GlobalSign, SSL.com, CFCA, OISTE and SECOM (bug 2081411, bug 2081595, bug 2081961, bug 2082334, bug 2080892, bug 2081155). At several of them the "EV" test pages served ordinary DV or OV certificates. Amazon said it has not issued an EV certificate since 2019, although five of its roots are still enabled for EV.

Four reports filed on October 16 say that ITI (Brazil), MULTICERT, Consorci AOC and Entrust published audit statements later than the 92 days the rules allow, without a letter from the auditor explaining the delay (bug 2083075, bug 2083076, bug 2083077, bug 2083078). For Entrust's AffirmTrust and Entrust 4K roots, the newest audit period ended in February 2025.

Besides its OCSP report, eMudhra filed four more this week (bug 2081185, bug 2082408, bug 2082782, bug 2082872). One shows how exact the rules are: its certificates were valid for 90 days and one second, while its own policy allows 90 days at most. The others cover seven intermediates missing the extension that limits what they may be used for (none of them has issued a certificate), certificates missing one of eMudhra's own policy identifiers, and policy documents that were out of date.

KIR, a Polish CA, issued three TLS certificates for its own websites from an old CA after promising Chrome that from August 12 it would use only its new TLS hierarchy (bug 2082585). No customers were affected, and KIR turned off TLS issuance from the old CA on October 14.

Two more revocation lists were late. DigiCert published one 24 hours, 3 minutes and 18 seconds after a revocation, just over the 24-hour limit (bug 2081712). GoDaddy's full report on its own late lists blames caching: its CDN kept serving old copies after new ones were signed (bug 2077611).

Two stories from earlier weeks are still open. Sectigo's count of active certificates covered by its disputed wording fell to 76.5 million on October 14, from 81.7 million a week earlier, mostly because they are expiring rather than being revoked (bug 2069640). Firmaprofesional has still not revoked its old SHA-1 intermediate. It plans to revoke one of the last time-stamping certificates under it on October 19, and has posted its full report on leaving that CA out of its audits (bug 2072600, bug 2077459).

* Revocation monitoring is available on Business and Enterprise plans

A weekly summary of certificate authority incidents and compliance activity, sourced from Mozilla's public CA Program tracker.

New this week

• GoDaddy: Delayed Certificate Revocation - source
• certSIGN: OCSP responder certificate encoded subject attributes out of order - source
• certSIGN: Missing localityName in an OV certificate - source
• certSIGN: Missing the countryName attribute in the Subject DN of a test DV TLS certificate - source
• D-TRUST Subordinate CA Records: Outdated CPS Effective Dates in CCADB - source
• OISTE: Specific test websites for EV not listed in CCADB - source
• Telekom Security / DFN: CRL validity period exceeds 10 days by one second - source
• NAVER Cloud Trust Services: Subordinate CA certificates with two Reserved Certificate Policy Identifiers - source
• Asseco DS / Certum: Delayed preliminary CPR response due to email address typo - source
• DigiCert: cRLNumber not increasing within one CRL scope - source
• TrustAsia: CAA Mis-Issuance - source
• NAVER Cloud Trust Services: Cross-certificate with incorrect accessMethod (id-ad-ocsp instead of id-ad-caIssuers) in AIA - source
• Entrust: AffirmTrust and Entrust 4K roots — newest audit period ended 2025-02-28, statement 119 days late, no letter, no newer period on record - source
• Consorci AOC (CATCert): EC-ACC audit statement 123 days after period end, no letter, no audit period newer than 2024-03-28 - source
• MULTICERT: Standard audit statement 108 days after period end with no explanatory letter; TLS BR audit on record ended 2023-03-31 - source
• ITI (Brazil): Autoridade Certificadora Raiz Brasileira v10 — audit statement 144 days after period end, no explanatory letter, no newer audit on record - source
• eMudhra emSign PKI Services: CP/CPS documents not updated for current requirements - source
• D-Trust: Finding #2 of 2 in 2026 ETSI Audit – Documentation of backup recovery testing - source
• D-Trust: Finding #1 of 2 in 2026 ETSI Audit – vulnerability management - source
• ACCV: EKU Inconsistency in ACCV RSA1 TLS CA Certificates Identified During Chrome Root Inclusion Review - source
• Telekom Security: Typographical error in CPS section 7.1.6 - source
• eMudhra emSign PKI Services: TLS certificates missing certificate-type policy OID required by CP/CPS - source
• GoDaddy: Subscriber Certificate Profiles Did Not Conform to CP/CPS - source
• D-TRUST: Reported CA key-size inconsistency in TSPS v3.1 - source
• KIR: TLS certificates issued from legacy SZAFIR Trusted CA6 contrary to Chrome commitments - source
• FNMT: Late CP/CPS Update in CCADB - source
• eMudhra emSign PKI Services: TLS certificates exceed CP/CPS maximum validity period by one second - source
• Asseco DS / Certum: Incomplete CRL Disclosure in CCADB for intermediate CAs sharing the same subjects and public keys as root CAs - source
• CFCA: Test websites for EV roots serve OV certificates - source
• SSL.com: Test websites for EV enabled Roots with non-EV certificates - source
• DigiCert: Publishing timeline for CRL - source
• D-Trust: Discrepancy in CRL URL Disclosures - source
• GlobalSign: EV Test Certificates missing for 2 roots - source
• Amazon Trust Services: EV Root Test Web Pages Serve Non-EV (DV) Certificates - source
• ANF: Potential TLS BR 7.1.2.8 violations in OCSP responder certificate - source
• eMudhra emSign PKI Services: Missing EKU Extension in Subordinate CA Certificates - source
• SECOM: Incorrect and missing EV TLS test websites in CCADB - source

Updates on open incidents

• DigiCert: Revocation of Undisclosed Issuing CAs - source
• ACCV: Delayed revocation related to Bugzilla #2061746 - source
• GoDaddy: Delayed Revocation of SHA-1 Signed Subordinate CA Certificates - source
• Actalis: Root CA CRL not published within 24 hours after recording revocations - source
• IZENPE: revocation reason code not included in CRL issued by Root - source
• Actalis: Incorrect Revocation dates in CRL entries - source
• Firmaprofesional: Delayed revocation of SHA-1-signed AC Firmaprofesional - CA1 - source
• Sectigo: No revocation after CP/CPS language involving extendedKeyUsage found to be subject to multiple interpretations - source
• Microsec: Insufficent support for "unspecified (0)" revocation reason - source
• Actalis: Non-compliant OCSP responses and OCSP responder certificate - source
• D-Trust: Missing Pre-Signing Linting for TLS Issuance - source
• Telekom Security: Failure in automatic issuance of CRLs - source
• Telekom Security: OCSP responder uses incorrect signature algorithm for P-384 signing key - source
• ACCV: OCSP responses include “archiveCutoff” in “responseExtensions” - source
• ACCV: Issuance of Server TLS Certificates with CP/CPS Discrepancies - source
• Disig: CRL contains not allowed attributes - source
• KIR: SZAFIR ROOT CA3 TLS CRL nextUpdate exceeds 12 months - source
• SECOM: Missing Prior Notification and Approval for a Cross-Certificate Extending Trust to Externally-Operated JPRS CAs - source
• iTrusChina: OCSP Response ECDSA signatureAlgorithm with NULL parameters - source
• CFCA: Incorrect countryName values in OV subscriber certificates - source
• TunTrust: CP/CPS markdown version missing root program attestation - source
• DigiCert: Certificates issued for sanctioned entities - source
• GoDaddy: Delayed CRL Updates - source
• PKIoverheid: TSP KPN Delayed publication of audit attestation letters in the CCADB - source
• SSL.com: Inconsistent published CRL for one ICA - source
• Actalis: Incorrect CRL Distribution Point in TLS Server Certificates - source
• Apple: CRL is signed incorrectly - source
• SSL.com: MPIC not performed for specific DCV path - source
• SSL.com: CRL URL typo in CRL URL disclosed to CCADB - source
• SSL.com: Delayed disclosure of Timestamping CA in CCADB - source
• Sectigo: Certificates issued for sanctioned entities - source
• Kamu SM: Non-BR-Compliant OCSP Response Validity Interval - source
• Sectigo: Violation of TLS BR 7.1.3.2.2 in OCSP responses - source
• Sectigo: Signing infrastructure migration disrupted issuance of 2 CRLs - source
• Firmaprofesional: Chrome Root Progam Policy - Dedicated TLS hierarchy / EKU requirements - source
• Firmaprofesional: OCSP signature verification errors for Secure Web 2024 certificates - source
• Firmaprofesional: Delayed preliminary CPR response due to incomplete mailbox monitoring coverage - source
• Firmaprofesional: AC Firmaprofesional - CA1 excluded from audit scope - source
• eMudhra emSign PKI Services: InCommon RSA IGTF Server CA 4 — certificates issued with key sizes not permitted by CPS - source
• iTrusChina: Reusing CRLnumber and Missing NULL Parameter of CRL signatureAlgorithm - source
• DigiCert: Expired CRL - source
• SSL.com: Invalid combinations of countryName, stateOrProvinceName, and localityName attributes - source
• SSL.com: Failure to respond to Certificate Problem Report within 24 hours - source
• Asseco DS / Certum: CRL URLs in issued certificates not disclosed in CCADB - source
• Asseco DS / Certum: Incorrect ECDSA-SHA384 AlgorithmIdentifier Encoding in CRLs - source
• TWCA: Non-critical basicConstraints in Delegated OCSP Responder Certificates - source
• BEIJING CERTIFICATE AUTHORITY Co., Ltd.: OCSP responses with an empty singleExtensions - source
• Telia: CRL signature algorithm property non-conformance for EC issuer key - source
• Chunghwa Telcom: Delay of 2025 WebTrust for CA Audit Reports seals for ePKI & HiPKI - source
• eMudhra emSign PKI Services: InCommon IGTF SSL CPS missing conformance statement for Baseline Requirements - source
• NAVER Cloud Trust Services: OCSP responses with an empty responseExtensions - source
• Netlock: CA in AIA in PEM format - source
• NETLOCK: Certificate Problem Report [CRL BR S7.2.2] - source
• Google Trust Services: CPS Missing root program attestation - source
• SSL.com: Failure to Post all Root and Intermediate CA certificates in Repository identified in CP/CPS - source
• Actalis: Issuance of Server TLS Certificates with id-kp-clientAuth against CPS - source
• Actalis: Undisclosed Subordinate CA Certificate - source
• Hongkong Post: CRL HTTP endpoints returned legacy media type application/x-pkcs7-crl - source
• SHECA: Incorrect Disclosure of Partitioned CRLs in CCADB - source
• SwissSign: Backdating of 48+h - source
• Sectigo: CP/CPS language involving extendedKeyUsage found to be subject to multiple interpretations - source
• Let's Encrypt: Root CRLs Missing Reason Code - source
• Sectigo: Failure to announce completion of action item within prescribed time period - source
• Asseco DS / Certum: Multi-purpose Subordinate CA with missing EKU - source
• SHECA: ECC CRL/OCSP Signature Algorithm Issue - source
• SHECA: CP/CPS lacks explicit adherence statement - source
• Sectigo: Submitted CPR not replied to within 24 hours - source
• D-Trust: Incorrect CPS URLs in CCADB for six S/MIME CA certificate records - source
• DigiCert: EV JOI match with organizationIdentifer - source
• NETLOCK: OCSP Service Returning Error for Issued Certificate - source
• D-Trust: Missing Pre-Sign Linting for S/MIME Issuing CAs - source
• Asseco DS / Certum: Incorrect AlgorithmIdentifier Encoding in OCSP responses - source
• Sectigo: Legacy Subordinate CA Certificate without digitalSignature KU signing OCSP responses - source
• CFCA: Certificates Issued with lower case value in subject:countryName - source
• eMudhra emSign PKI Services: Delegated OCSP Responder certificates containing cRLDistributionPoints extension - source
• Certigna: Failure to announce completion of action item within prescribed time period - source

Resolved this week

• SwissSign: Delayed revocation related to Bugzilla 2033000 - source
• eMudhra: Invalid CRL signatures - source
• Asseco DS / Certum: EV TLS Certificate Issued with Branch Name as Subject Organization Name - source
• Certigna: CRL HTTP Media Type - source
• D-TRUST: Incomplete Disclosure of CRL URLs - source
• Kamu SM: Missing CRL Disclosure for Cross-Signed CA in CCADB - source