Daily digest of CA/Browser Forum posts and Mozilla CA incompliance caseshttps://certdesk.dev/en/news/https://bugzilla.mozilla.org/show_bug.cgi?id=2075720https://bugzilla.mozilla.org/show_bug.cgi?id=2075720NETLOCK reported an issue with the CRL of its root CA, NetLock Arany (Class Gold) Főtanúsítvány, where two different versions were served under the same cRLNumber (39), violating RFC 5280 §5.2.3 and CA/Browser Forum Baseline Requirements §7.2.2. NETLOCK is investigating the matter.Fri, 25 Sep 2026 00:00:00 GMTincidenthttps://bugzilla.mozilla.org/show_bug.cgi?id=2075655https://bugzilla.mozilla.org/show_bug.cgi?id=2075655Actalis: Incorrect Revocation dates in CRL entriesFri, 25 Sep 2026 00:00:00 GMTincidenthttps://bugzilla.mozilla.org/show_bug.cgi?id=2075606https://bugzilla.mozilla.org/show_bug.cgi?id=2075606KIR confirmed that the CRL issued by SZAFIR ROOT CA3 TLS had a nextUpdate value exceeding 12 months. The same issue was found in the CRL issued by SZAFIR ROOT CA5 SMIME. KIR issued new CRLs with corrected nextUpdate values, in compliance with the Baseline Requirements.Fri, 25 Sep 2026 00:00:00 GMTincidenthttps://bugzilla.mozilla.org/show_bug.cgi?id=2075527https://bugzilla.mozilla.org/show_bug.cgi?id=2075527Firmaprofesional received a report on September 23, 2026, identifying certificateHold reasonCode entries in the public CRL for AC Firmaprofesional - CUALIFICADOS. The company is investigating whether these entries constitute non-compliance with TLS Baseline Requirements §§ 4.9.13 and 7.2.2. The review includes an assessment of the CRLs and the affected certificates.Fri, 25 Sep 2026 00:00:00 GMTincidenthttps://bugzilla.mozilla.org/show_bug.cgi?id=2075488https://bugzilla.mozilla.org/show_bug.cgi?id=2075488Telia's EC TLS DV CA v4 issued CRLs have a non-conformance issue with the signature algorithm property. The same issue was found in Telia EC TLS Root CA v3, Telia EC Email Root CA v3, Telia EC Client Root CA v3, and Telia EC Signing Root CA v3. The issue is due to an incorrect CA configuration setting.Fri, 25 Sep 2026 00:00:00 GMTincidenthttps://bugzilla.mozilla.org/show_bug.cgi?id=2075258https://bugzilla.mozilla.org/show_bug.cgi?id=2075258NETLOCK was reported for not disclosing CRL Distribution Point URLs in the CCADB for the corresponding issuing CA. The issue was reported by a third party and NETLOCK is investigating. According to CCADB Policy §6.2, CA Owners must disclose these URLs to the CCADB within 7 days of issuing the first certificate containing the URL or within 4 hours of revoking it.Thu, 24 Sep 2026 00:00:00 GMTincidenthttps://bugzilla.mozilla.org/show_bug.cgi?id=2075255https://bugzilla.mozilla.org/show_bug.cgi?id=2075255A third party reported that NETLOCK's issuing CAs' CRLs contain entries with the reasonCode set to unspecified (0), violating CA/Browser Forum Baseline Requirements §7.2.2. NETLOCK has received the report and is investigating. A full incident report will follow.Thu, 24 Sep 2026 00:00:00 GMTincidenthttps://bugzilla.mozilla.org/show_bug.cgi?id=2075247https://bugzilla.mozilla.org/show_bug.cgi?id=2075247Amazon Trust Services – CP/CPS for externally operated subordinate CAs not updated in CCADB within 14 daysThu, 24 Sep 2026 00:00:00 GMTincidenthttps://bugzilla.mozilla.org/show_bug.cgi?id=2075242https://bugzilla.mozilla.org/show_bug.cgi?id=2075242Certum found 15 CRLs with incorrect ECDSA-SHA384 AlgorithmIdentifier encoding on 2026-09-23. The issue affects CRLs generated by Certum and violates the CA/Browser Forum Baseline Requirements and RFC 5758. The affected CRLs have been identified by Certum.Thu, 24 Sep 2026 00:00:00 GMTincidenthttps://bugzilla.mozilla.org/show_bug.cgi?id=2075234https://bugzilla.mozilla.org/show_bug.cgi?id=2075234Asseco DS / Certum: CRL URLs in issued certificates not disclosed in CCADBThu, 24 Sep 2026 00:00:00 GMTincidenthttps://bugzilla.mozilla.org/show_bug.cgi?id=2074980https://bugzilla.mozilla.org/show_bug.cgi?id=2074980SSL.com's external auditors found that the company failed to post all Root and Intermediate CA certificates in its repository as required by its CP/CPS. The CP/CPS states that all Root and Intermediate CA certificates used by the SSL.com PKI must be available in the repository. SSL.com is required to post the certificates in accordance with the Baseline Requirements and its CP/CPS.Wed, 23 Sep 2026 00:00:00 GMTincidenthttps://bugzilla.mozilla.org/show_bug.cgi?id=2074944https://bugzilla.mozilla.org/show_bug.cgi?id=2074944Let's Encrypt revoked the Cross-Certified Subordinate CA Certificates of ISRG Root X2, Root YR, and Root YE with reason code "superseded", but due to a bug in the ceremony tool, the reason code entry extension was omitted. Only two Root CRLs issued by ISRG Root X1 and ISRG Root X2 are impacted. The incident is contained since Root CRLs are only issued as part of manual ceremonies.Wed, 23 Sep 2026 00:00:00 GMTincidenthttps://bugzilla.mozilla.org/show_bug.cgi?id=2074611https://bugzilla.mozilla.org/show_bug.cgi?id=2074611DigiCert: EV JOI match with organizationIdentiferTue, 22 Sep 2026 00:00:00 GMTincidenthttps://bugzilla.mozilla.org/show_bug.cgi?id=2074466https://bugzilla.mozilla.org/show_bug.cgi?id=2074466SwissSign issued a TLS certificate with a notBefore value exceeding the maximum backdating period permitted by CA/Browser Forum Baseline Requirements 7.1.2.7. The certificate was signed on 2026-09-20 12:35:51 UTC with a notBefore value of 2026-09-18 11:57:03 UTC, resulting in a backdating interval of approximately 48 hours, 38 minutes, and 48 seconds. This exceeds the maximum permitted backdating period of 48 hours.Tue, 22 Sep 2026 00:00:00 GMTincidenthttps://bugzilla.mozilla.org/show_bug.cgi?id=2074032https://bugzilla.mozilla.org/show_bug.cgi?id=2074032KPN PKIoverheid failed to upload the required Audit Attestation Letter to the CCADB for subCAs within the 92-day deadline, which expired on 2026-08-31. The letters were uploaded on 2026-09-10 and again on 2026-09-15. The relevant policies include CCADB Policy v2.1, Mozilla Root Store Policy v3.1, and Microsoft Trusted Root Certificate Program.Mon, 21 Sep 2026 00:00:00 GMTincidenthttps://cabforum.org/2026/09/03/ballot-sc104-set-presence-of-aia-extension-to-should-for-subscriber-certificates/https://cabforum.org/2026/09/03/ballot-sc104-set-presence-of-aia-extension-to-should-for-subscriber-certificates/Ballot SC104 sets the presence of the AIA extension to SHOULD for Subscriber Certificates. The voting results showed a total of 21 votes. According to the Baseline Requirements, CAs must provide CRL and OCSP.Thu, 03 Sep 2026 00:00:00 GMTballothttps://cabforum.org/2026/08/11/ballot-smc-018/https://cabforum.org/2026/08/11/ballot-smc-018/The CA/Browser Forum is conducting a 30-day review period for Ballot SMC018: Realignment of Multipurpose use cases, which pertains to Final Maintenance Guidelines. The complete Draft Maintenance Guideline is available here. This review is being conducted pursuant to Section 4.1 of the CA/Browser Forum’s Intellectual Property Rights Policy (v1.4).Tue, 11 Aug 2026 00:00:00 GMTballothttps://cabforum.org/2026/08/06/ballot-sc100-dnssec-clarification-and-consolidation/https://cabforum.org/2026/08/06/ballot-sc100-dnssec-clarification-and-consolidation/Ballot SC100 clarifies and consolidates DNSSEC-related provisions. Certificate Issuers must follow the Baseline Requirements. The ballot was decided with 22 votes in total.Thu, 06 Aug 2026 00:00:00 GMTballothttps://cabforum.org/2026/07/14/ballot-sc102-ev-domain-reuse-and-validity-alignment/https://cabforum.org/2026/07/14/ballot-sc102-ev-domain-reuse-and-validity-alignment/CAs voted on Ballot SC102, with a total of 19 votes. Ballot SC102 addresses EV Domain Reuse and Validity Alignment in the Baseline Requirements.Tue, 14 Jul 2026 00:00:00 GMTballothttps://cabforum.org/2026/07/01/ballot-sc0101v2-clarify-authorization-domain-names/https://cabforum.org/2026/07/01/ballot-sc0101v2-clarify-authorization-domain-names/The CA must specify Authorization Domain Names according to the Baseline Requirements. Ballot SC0101v2 is a vote to clarify Authorization Domain Names. There were a total of 27 votes.Wed, 01 Jul 2026 00:00:00 GMTballothttps://cabforum.org/2026/06/16/ballot-csc-32-make-a-reserved-policy-oid-mandatory/https://cabforum.org/2026/06/16/ballot-csc-32-make-a-reserved-policy-oid-mandatory/Ballot CSC-32 was adopted on November 17, 2025, and the new CSC BRs v3.10.0 have been published to the CABF public website. No IPR Exclusion Notices were filed. Ballot CSC-32 makes a Reserved Policy OID mandatory.Tue, 16 Jun 2026 00:00:00 GMTballothttps://cabforum.org/2026/06/16/ballot-smc-017v2/https://cabforum.org/2026/06/16/ballot-smc-017v2/Ballot SMC017v2 increases the minimum RSA CA key size. The Intellectual Property Review period has been completed, and the ballot was adopted as of July 30, 2026. The new S/MIME BR v.1.0.15 has been published to the CABF public website.Tue, 16 Jun 2026 00:00:00 GMTballot