Open Bug 2049960 Opened 1 month ago Updated 2 days ago

Actalis: Undisclosed Subordinate CA Certificate

Categories

(CA Program :: CA Certificate Compliance, task)

Product:
CA Program
Component:
CA Certificate Compliance
Type:
task

Tracking

(Not tracked)

Status:
ASSIGNED

People

(Reporter: marco.menonna, Assigned: marco.menonna)

Details

(Whiteboard: [ca-compliance] [disclosure-failure])

Preliminary Incident Report

Summary

  • Incident description: Actalis was notified that a subordinate CA certificate chaining to Actalis Authentication Root CA appears not to be disclosed in CCADB. An investigation has been initiated to determine the cause of the missing disclosure and to assess whether additional certificates may be affected.

  • Relevant policies: CCADB Policy v 2.1, Section 3.2 (Subordinate CA Certificates).

  • Source of incident disclosure: Third Party Reported

Actalis has completed the CCADB disclosure for Actalis Code Signing CA G2:
https://crt.sh/?sha256=8CC827CEA1CD8DB79AEB7CD4BEEAE36658AF7B4C0606C257B7538AB1E710BC6A

We will provide further updates and the full incident report in the coming days.

Assignee: nobody → marco.menonna
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true
Whiteboard: [ca-compliance] [disclosure-failure]

We are continuing our internal analysis and will publish the Full Incident Report within the expected timeline.

In the meantime, on 06/30/2026 at 15:50 CEST we disclosed on CCADB the SubCA Actalis Code Signing CA G1 - https://crt.sh/?sha256=28361D057C49D023952FD459D39C2EB8FE497AA8B57D0FDF4820A6CF009768CF
Based on our preliminary assessment, this SubCA appears to be out of scope for this bug, as it was revoked in 2020.

We will provide further updates as soon as possible.

Full Incident Report

Summary

  • CA Owner CCADB unique ID: A000001

  • Incident description: Actalis was notified by a Root Program representative that the subordinate CA certificate Actalis Code Signing CA G2 - SHA-256: 8CC827CEA1CD8DB79AEB7CD4BEEAE36658AF7B4C0606C257B7538AB1E710BC6A - ,issued on 2020-07-06 by Actalis Authentication Root CA, had not been disclosed in the CCADB. The affected certificate is a Subordinate CA certificate used only for Code Signing certificate issuance.

  • Timeline summary:

    • Non-compliance start date: 2022-04-01 - date from which Apple's disclosure requirement became applicable to pre-existing subordinate CA certificates.
    • Non-compliance identified date: 2026-06-24.
    • Non-compliance end date: 2026-06-24.

  • Relevant policies: CCADB Policy v 2.1, Section 3.2 Subordinate CA Certificates; Apple Root Certificate Program version December 1, 2021.

  • Source of incident disclosure: Third Party Reported.

Impact

  • Total number of certificates: 1 - Actalis Code Signing CA G2

  • Total number of "remaining valid" certificates: 1

  • Affected certificate types: Code Signing Subordinate CA certificate. This incident does not affect DV, OV, IV, or EV TLS server certificates. No end-entity certificates are affected by this bug.

  • Incident heuristic: The currently identified affected corpus consists of subordinate CA certificates issued under Actalis Authentication Root CA that:
    -- are capable of validating to a CA certificate included in the Apple Root Program;
    -- were not disclosed in CCADB; and
    -- were valid and not revoked.

Actalis has currently identified one remaining valid affected certificate: Actalis Code Signing CA G2.

During internal analysis, Actalis also identified Actalis Code Signing CA G1, issued in 2019 and revoked in November 2020. Because this certificate was revoked before the 2022-04-01 effective date of the Apple Root Program disclosure requirement, Actalis has defined it as a historical variant and is not currently counting it as a remaining valid affected certificate.

  • Was issuance stopped in response to this incident, and why or why not?
    No. Issuance was not stopped because the incident concerns missing CCADB disclosure of a Subordinate CA certificate, rather than an identified defect in subscriber certificate issuance, certificate profiles, subscriber validation, revocation processing, key protection or in general security matters.

  • Analysis: N/A

  • Additional considerations: /

Timeline

All times are CEST.

Date/Time CEST Event
2020-07-06 Actalis Code Signing CA G2 issued by Actalis Authentication Root CA. No CCADB disclosure obligation in effect at this date.
2022-04-01 Apple Root Program Policy Section 2.1.1, CA Disclosure, became effective, requiring CA owners to disclose in CCADB all CA Certificates chaining to their CA Certificates included in the Apple Root Program.
2025-07-15 CCADB Policy v2.0 enters into force, introducing a general CCADB requirement to disclose all subordinate CA certificates capable of validating to a certificate included in a Root Store or associated with a CCADB Root Inclusion Reques.
2026-06-24 00:50 Actalis received a third-party report indicating the missing CCADB disclosure o Actalis Code Signing CA G2.
2026-06-24 08:30 Actalis initiated internal triage and began reviewing the certificate’s CCADB disclosure status.
2026-06-24 09:22 Actalis opened Bugzilla Bug 2049960 and posted the Preliminary Incident Report.
2026-06-24 16:35 Disclosure of Actalis Code Signing CA G2 completed in CCADB.
2026-06-30 15:50 Actalis disclosed on CCADB the SubCA Actalis Code Signing CA G1 - https://crt.sh/?sha256=28361D057C49D023952FD459D39C2EB8FE497AA8B57D0FDF4820A6CF009768CF.

Related Incidents

Bug Date Description
https://bugzilla.mozilla.org/show_bug.cgi?id=1982646 2025-08-12 Actalis: missing CCADB disclosure for new SubCA
https://bugzilla.mozilla.org/show_bug.cgi?id=1904041 2025-07-01 NETLOCK: Intermediate CA Certificate not disclosed to CCADB
https://bugzilla.mozilla.org/show_bug.cgi?id=1965559 2025-05-09 eMudhra: Delayed Publication of Issuing CA Certificates In CCADB
https://bugzilla.mozilla.org/show_bug.cgi?id=1921596 2024-09-28 KIR: Failure to disclose intermediate certificate within 7 days in ccadb
https://bugzilla.mozilla.org/show_bug.cgi?id=1904041 2024-06-21 NETLOCK: Intermediate CA Certificate not disclosed to CCADB

Root Cause Analysis

Contributing Factor #1: Absence of a disclosure obligation at time of issuance of Actalis Code Signing CA G2

  • Description: When Actalis Code Signing CA G2 SubCA was issued in July 2020, neither the Apple Root Certificate Program nor the CCADB Policy required disclosure of subordinate CA certificates. There was therefore no process trigger at issuance.

  • Timeline: The certificate was issued on 2020-07-06. The Apple Root Program entered into force on 2022-04-01, approximately 21 months later.

  • Detection: This factor was detected after Actalis received the third-party report.

  • Interaction with other factors: This factor created the initial condition for non-compliance.

  • Root Cause Analysis methodology used: 5 Whys.

Contributing Factor #2: Incorrect scoping assumption after April 2022

  • Description: When the first Apple disclosure requirement entered into force in April 2022, Actalis did not interpret it as applying retroactively to subordinate CA certificates already in existence. This assumption was reinforced by the consideration that the Actalis Code Signing CA G2 issues Code Signing certificates that fall outside the scope of the Apple Root Program. As a result, no retroactive or new disclosures was initiated at that moment.

  • Timeline: As above.

  • Detection: Not detected internally. Identified by external notification on 2026-06-24.

  • Interaction with other factors: This factor prevented corrective action that would otherwise have mitigated Contributing Factor #1 and #3.

  • Root Cause Analysis methodology used: 5 Whys.

Contributing Factor #3: CCADB disclosure controls were event-driven and did not include periodic full inventory reconciliation

  • Description: Actalis' CCADB disclosure process relied primarily on operational events, such as the issuance of new subordinate CA certificates and updates to existing CCADB records. It did not include a periodic control that compared the complete internal inventory of subordinate CA certificates capable of chaining to root store-included certificates against CCADB disclosure records.

    As a result, a pre-existing subordinate CA certificate that became subject to a later disclosure requirement was not detected as missing from CCADB.

  • Timeline: This factor existed before 2022-04-01 and continued until the issue was reported on 2026-06-24.

  • Detection: The factor was detected during the internal review triggered by the third-party report.

  • Interaction with other factors: This factor allowed the incomplete interpreation to persist.

  • Root Cause Analysis methodology used: 5 Whys.

Lessons Learned

  • What went well: Actalis responded promptly upon receiving the notification, initiating both internal investigation and CCADB disclosure procedures on the same day.

  • What didn't go well: Actalis lacked a process for reviewing existing subordinate CA certificates disclosures, including subordinate CAs that had already been revoked,. Changes to Root Program policies were not systematically evaluated for retroactive applicability to pre-existing certificates.

  • Where we got lucky: The certificate in question issues Code Signing certificates only, which do not affect TLS trust chains or end-user browsing security.

  • Additional: /

Action Items

Action Item Kind Corresponding Root Cause(s) Evaluation Criteria Due Date Status
Complete CCADB disclosure of Actalis Code Signing CA G2 Prevent #1, #2 Certificate visible as disclosed in CCADB 2026-06-24 Done
Establish a formal process for reviewing existing subordinate CA inventory upon Root Program policy updates Prevent #2, #3 Process documented and integrated into Actalis compliance procedures; verifiable at next audit 2026-09-30 Planned
Implement periodic self-audit of subordinate CA disclosure status against CCADB Detect #3 Quarterly check procedure documented and first execution completed 2026-10-30 Planned

Appendix

Certificate details:

https://crt.sh/?sha256=8CC827CEA1CD8DB79AEB7CD4BEEAE36658AF7B4C0606C257B7538AB1E710BC6A

Weekly Update

We are on track with the planned action items.
In the meantime, we are continuing to monitor this bug.

Weekly Update

Progress is aligned with our scheduled action items.
We remain at your disposal for any further details.

Weekly Update

Progress is aligned with our scheduled action items.
We remain at your disposal for any further details.

Weekly Update

Progress is aligned with our scheduled action items.
We remain at your disposal for any further details.

Weekly Update

Progress is aligned with our scheduled action items.
We remain at your disposal for any further details.

Weekly Update

Progress is aligned with our scheduled action items.
We remain at your disposal for any further details.

You need to log in before you can comment on or make changes to this bug.