1982646 - Actalis: missing CCADB disclosure for new SubCA

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[Nicolò Papi]

Preliminary Incident Report

Summary

Incident description

On August 11 2025, a third party reported to us that our newly-created SubCA issued publicly-trusted certificates before being disclosed on CCADB.

On July 07 2025, we generated a new SubCA for the new PKI hierarchy intended for disclosure in the near future. The newly-generated SubCA had not been previously disclosed on CCADB because, under the applicable CCADB policy at the time of creation (version 1.3.1, section 4), disclosure was required "before the certificate begins issuing publicly-trusted certificates".
The newly-created SubCA, "Actalis Domain Validated TLS Server RSA CA 2025", issued three precertificates restricted to the domain "active.ssltest-dv-rsa-2025.actalis.it" - https://crt.sh/?Identity=%25&iCAID=423983 .
This domain had been created in order to demostrated, at the time of new root inclusion request, support for at least one automated method of certificate issuance as required by Mozilla Root Store Policy (version 3.0, section 7.1).

On July 30 2025, we generated "Actalis TLS Server RSA Root CA 2025" cross-certificate, which was subsequently revoked on August 07 2025 and replaced in the same day with a new one. As a result, the three certificates issued by the newly-generated SubCA "Actalis Domain Validated TLS Server RSA CA 2025" became publicly-trusted.

As described above, the incident is strictly limited to the test domain "active.ssltest-dv-rsa-2025.actalis.it" and affects in total the three above mentioned certificates.
On August 11 2025, we disclosed on CCADB the new cross-certificates "Actalis TLS Server RSA Root CA 2025" - https://crt.sh/?caid=423982 - and the SubCA "Actalis Domain Validated TLS Server RSA CA 2025" - https://crt.sh/?caid=423983 .

This issue is not related to others SubCAs, disclosed on CCADB on August 11 2025, which have never issued any certificates.

Relevant policies

CCADB Policy (version 2.0 section. 3.2 and version 1.3.1 section 4), Mozilla Root Store Policy (version 3.0 section 7.1), Chrome Root Program Policy (version 1.7 section 4.1.2)

Source of incident disclosure
Third party reported

Comment 1

[Nicolò Papi]

Weekly update

We are defining the action items and timelines to be included in the final report.
We will provide a new update by 2025-08-26.

Comment 2

[Nicolò Papi]

Full Incident Report

Summary

• CA Owner CCADB unique ID: A000001
• Incident description: Actalis: missing CCADB disclosure for newly-created SubCAs
• Timeline summary:
  • Non-compliance start date: 2025-07-30
  • Non-compliance identified date: 2025-08-11
  • Non-compliance end date: 2025-08-11
• Relevant policies: CCADB Policy (version 2.0 section 3.2 and version 1.3.1 section 4), Mozilla Root Store Policy (version 3.0 section 7.1), Chrome Root Program Policy (version 1.7 section 4.1.2)
• Source of incident disclosure: Third party reported

Impact

• Total number of certificates: 15 certificates:
  • 3 end-entity certificates
  • 5 cross-certificates
  • 7 newly-created SubCA certificates

More details are provided in the attached file.

• Total number of "remaining valid" certificates: 12 certificates as described in .csv file attached

• Affected certificate types: TLS domain validated certificates, limited to the test domain "active.ssltest-dv-rsa-2025.actalis.it", cross-certificates and newly-created SubCAs.

• Incident heuristic: The full corpus of affected certificates are disclosed in .csv attached.

• Was issuance stopped in response to this incident, and why or why not?: Yes

• Analysis: See section Root Cause Analysis

• Additional considerations: N/A

Timeline

All times are CEST.

• 2025-07-07: We generated the seven new SubCAs (see csv file attached for more details) for the new PKI hierarchy, intended for disclosure on CCADB at a later date. At the time of creation, the applicable CCADB Policy was the version v. 1.3.1

• 2025-07-30:

  • The certificate crt.sh ID - 20009243942 was issued by the newly-created SubCA "Actalis Domain Validated TLS Server RSA CA 2025";
  • The cross-certificates “Actalis TLS Server RSA Root CA 2025”, "Actalis TLS Server ECC Root CA 2025" "Actalis SMIME RSA Root CA 2025" was issued;
  • The certificate crt.sh ID - 20009243942 and all the newly-created SubCA listed in .csv attached file became publicly-trusted.

• 2025-08-01: We disclosed the cross-certificates “Actalis TLS Server RSA Root CA 2025” and "Actalis TLS Server ECC Root CA 2025" on CCADB.

• 2025-08-07:

  • The certificate crt.sh ID - 20009243942 was rekoved (superseded);
  • The certificates crt.sh ID - 20156356832 & 20161071220 were issued publicly-trusted by the newly-created SubCA "Actalis Domain Validated TLS Server RSA CA 2025";
  • The cross-certificates “Actalis TLS Server RSA Root CA 2025” and "Actalis TLS Server ECC Root CA 2025" was revoked and replaced with the new ones https://crt.sh/?id=20285006523 and https://crt.sh/?q=20284544973.

• 2025-08-11:

  • A third party reported to us that our newly-created SubCA "Actalis Domain Validated TLS Server RSA CA 2025" issued publicly-trusted certificates before being disclosed on CCADB;
  • A response has been provided to the report received from the third party;
  • All the SubCAs and cross-certificates listed in .csv file attached, included the replaced ones, were disclosed on CCADB;

• 2025-08-12:

  • The preliminary report above was disclosed to Bugzilla.

Related Incidents

• https://bugzilla.mozilla.org/show_bug.cgi?id=1965559
• https://bugzilla.mozilla.org/show_bug.cgi?id=1921596
• https://bugzilla.mozilla.org/show_bug.cgi?id=1451950
• https://bugzilla.mozilla.org/show_bug.cgi?id=1904041

Root Cause Analysis

This incident occurred in the context of the activities that Actalis has been carrying out for some time with the aim of submitting new Root CAs to the CCADB.
After creating our new Roots, on July 7th we created new SubCAs under them, to be able to issue demonstration TLS certificates.
At that time, there was no requirement to disclose those new SubCAs because they belonged to an untrusted hierarchy, in addition the applicable CCADB policy (version 1.3.1 - section 4) didn't require the disclosure before issuing publicly-trusted certificates.
We subsequently decided to issue cross-certificates (from our old root to our new roots), which we did on July 30th. At that point, disclosure of these cross-certificates was required, which we did somewhat late (on August 11). Furthermore, we didn't immediately consider that, as a consequence of creating our cross-certificates, disclosure of our new SubCAs was also required; we also discloused these SubCAs on August 11.
Actually, a discussion had already been underway within Actalis in the preceding days regarding the need to quickly disclose our new SubCAs, as this was the first time in many years of activity that Actalis had created cross-certificates. This state of affairs was also reflected in our procedures which did not expressly cover the case of cross-certification with regard to disclosure requirements.

Contribuing Factor #1: Lack of up-to-date internal procedures

• Description: The incident occurred because our internal procedure had not yet been updated to reflect the CCADB policy applicable as of July 15, 2025. Furthermore, since our CA had never issued any cross-certificates in the past decade, this specific scenario had not previously arisen. As a result, the implications associated with the issuance of the new cross-certificate, as required by the Chrome Root Program policy, were not fully recognized.
• Timeline: As described in above section.
• Detection: Third party reported on 2025-08-11 - see above timeline.
• Interaction with other factors: Two different versions of the CCADB Policy applied, respectively version 1.3.1 for the SubCA certificates and version 2.0 for the cross-certificates, depending on their date of issuance.
• Root Cause Analysis methodology used: Drilling Down.

Lessons Learned

• What went well: Only three TLS leaf certificates TLS DV were affected, all of which were associated with our internal test domain "active.ssltest-dv-rsa-2025.actalis.it".
• What didn’t go well: The implications of issuing the cross-certificates were not entirely recognized at the time.
• Where we got lucky: We became aware of the disclosure failure shortly after the deadline set by the CCADB policy, and in the meantime we have not issued any end-entity certificates under the new SubCAs except for one for demonstration purposes.
• Additional: N/A

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Review and update the internal Certificate Management Policy to include verification and disclosure activities for cross-certificates	Prevent	Root Cause # 1	External auditors will verify the updating and suitability of the new policy and related processes during the scheduled annual audits	2025-09-15	Ongoing
Update the internal process to also cover verification of cross-certificates, in addition to Sub-CA verification, ensuring that responsibilities, procedures, and timelines for the related activities are clearly defined	Prevent	Root Cause # 1	The internal audit will verify adherence to internal procedures during periodic checks	2025-10-15	Ongoing
Update the training course to include clear guidance on the procedures and timelines for publishing information in CCADB	Prevent	Root Cause # 1	Evaluation criteria will include quantitative measures such as assessment results and completion rates and qualitative methods, including participant feedback.	2025-11-15	Ongoing

Appendix

Affected certificates

The affected certificates was reported in the attachment.

Comment 3

[Nicolò Papi]

Attachment: attachment_affected_certificates.csv

Comment 4

[Nicolò Papi]

Weekly Update

We are on track with the planned action items.
In the meantime, we are continuing to monitor this bug.

Comment 5

[Nicolò Papi]

Weekly update

We are on track with the planned action items.
In the meantime, we are continuing to monitor this bug.

Comment 6

[Nicolò Papi]

Weekly Update

The first action item ("Review and update the internal Certificate Management Policy to include verification and disclosure activities for cross-certificates") has been completed.

We are on track with the remaining planned action items.
In the meantime, we are continuing to monitor this bug.

Comment 7

[Nicolò Papi]

Weekly Update

We are on track with the remaining planned action items.
In the meantime, we are continuing to monitor this bug.

Comment 8

[Nicolò Papi]

Weekly Update

We are on track with the remaining planned action items.
In the meantime, we are continuing to monitor this bug.

Comment 9

[Nicolò Papi]

Weekly Update

We are on track with the remaining planned action items.
In the meantime, we are continuing to monitor this bug.

Comment 10

[Nicolò Papi]

Weekly Update

We are on track with the remaining planned action items.
In the meantime, we are continuing to monitor this bug.

Comment 11

[Nicolò Papi]

Weekly Update

The second action item ("Update the internal process to also cover verification of cross-certificates, in addition to Sub-CA verification, ensuring that responsibilities, procedures, and timelines for the related activities are clearly defined") has also been completed.

The last one ("Update the training course to include clear guidance on the procedures and timelines for publishing information in CCADB.") is in progress.
In the meantime, we are continuing to monitor this bug.

Comment 12

[Colin]

The action items on this clearly address the problems that led to this incident, but they don't address the environment that created those problems.

What happens when CCADB or a Root Store changes the timelines? All these updates will be out of date, and it leaves Actalis exposed to committing the exact same incident for the exact same reasons.

Shouldn't there be an action item for continuous monitoring of requirements and regular process review for compliance?

Comment 13

[Nicolò Papi]

@Colin, thank you for your remark that highlights an important point: Actalis has an established Regulatory Observatory internal department that actively monitors and assesses all relevant regulatory updates. The Observatory ensures that any new or amended requirements are promptly identified and communicated to the responsible departments, facilitating timely alignment of internal procedures when necessary. This proactive approach has proven effective, for instance, in managing updates related to new versions of the Root Store Policies and CAB Forum Requirements ensuring continuous compliance with evolving regulatory frameworks.

In this specific case, however, the related procedure was not updated in time to reflect the Cross Certificate generation and disclosure activities carried out on July 30, 2025 partly because this was the first time such certificates were issued.

Comment 14

[Nicolò Papi]

Report Closure Summary

• Incident description:
  During the activities related to the submission of new Root CAs, the SubCA certificates and cross-certificates were not disclosed within the timelines required by the CCADB and Chrome Root Program policies.
  The issue was resolved on August 11, 2025, with the publication of all the required certificates.

• Incident Root Cause(s):
  The incident occurred because internal procedures had not yet been updated to reflect the CCADB policy effective July 15, 2025. Additionally, since no cross-certificates had been issued in the past decade, the related disclosure requirements were not fully recognized.

• Remediation description:
  Actalis reviewed and updated its internal Certificate Management Policy and related processes to include verification and disclosure requirements for cross-certificates. Responsibilities, procedures, and timelines were clearly defined and verified through internal and external audits. In addition, staff training was updated to provide clear guidance on CCADB publication procedures and deadlines.

• Commitment summary:
  Actalis is committed to maintaining full and continuous compliance with CCADB and browser root program requirements by ensuring that internal policies and procedures remain aligned with applicable standards. The company will regularly review its certificate management processes, reinforce staff awareness through periodic training, and rely on the proactive oversight of the Regulatory Observatory to ensure timely identification and incorporation of any new or updated regulatory requirements.

All Action Items disclosed in this report have been completed as described, and we request its closure.

Comment 15

[incident-reporting]

This is a final call for comments or questions on this Incident Report.

Otherwise, it will be closed on approximately 2025-11-04.