Firmaprofesional: Delayed publication of 2026 Audit Attestation Letters
Categories
(CA Program :: CA Certificate Compliance, task)
Tracking
(Not tracked)
People
(Reporter: clopez, Unassigned)
Details
Preliminary Incident Report
Summary
-
Incident description:
On 2026-07-15, while submitting the 2026 Audit Attestation Letters (AALs) to the CCADB, Autoridad de Certificacion Firmaprofesional identified that the statement date of 2026-07-15 was more than 92 calendar days after the audit period end date of 2026-03-27. The deadline established by Section 5.2 of the CCADB Policy was 2026-06-27.
The affected disclosures are the Standard, TLS Baseline Requirements, and TLS Extended Validation Guidelines AALs for the audit period from 2025-03-28 through 2026-03-27. The records reviewed to date have not identified a final AAL or a signed explanatory letter that was publicly provided by the deadline.
The final AALs have now been issued and entered in CCADB Case 00003334. A signed explanatory letter from the Qualified Auditor has been published in the Bugzilla
CA Documentscomponent: Bug 2055439.At this preliminary stage, the known impact is the delayed public availability of the three audit disclosures. The CA Owner is continuing to determine the complete timeline, whether any additional impact exists, the contributing factors, and the corrective actions. The incident therefore remains ongoing.
-
Relevant policies:
- CCADB Policy version 2.1, effective 2026-03-20, Section 5.2, requires authoritative English-language public audit information to be uploaded to the CCADB no later than 92 calendar days after the end of the audit period. If the audit information cannot be provided by that deadline, the CA Owner must instead upload a signed explanatory letter from the Qualified Auditor to Bugzilla in the
CA Documentscomponent by the same deadline. - CCADB Policy version 2.1, Section 6.1, and CCADB Incident Reporting Guidelines version 3.2 govern public disclosure and follow-up of this incident.
- CCADB Policy version 2.1, effective 2026-03-20, Section 5.2, requires authoritative English-language public audit information to be uploaded to the CCADB no later than 92 calendar days after the end of the audit period. If the audit information cannot be provided by that deadline, the CA Owner must instead upload a signed explanatory letter from the Qualified Auditor to Bugzilla in the
-
Source of incident disclosure:
Self Reported.
Description
•