2073233 - FNMT: Delayed Revocation of SHA-1 Signed Subordinate CA Certificate

Status: ASSIGNED

(CA Program :: CA Certificate Compliance, task)

Description

[Amaya Espinosa]

Preliminary Incident Report

Summary

• Incident description:
  FNMT did not revoke the unexpired SHA-1 signed subordinate CA certificate "AC Componentes Informáticos" by 2026-09-15, according to TLS Baseline Requirements.

  On September 15, 2026, at 15:19 UTC, FNMT was notified of this issue via email. After analyzing the case, FNMT confirmed that this CA contains a SHA-1-signed certificate. No other certificates are affected.

  FNMT is currently preparing for the revocation of the identified SHA-1-signed certificate.

• Relevant policies:
  CA/Browser Forum TLS Baseline Requirements section 7.1.3.2.1: "Prior to 2026-09-15, the CA SHALL revoke any unexpired Subordinate CA Certificate that contains RSASSA-PKCS1-v1_5 with SHA-1 within the Certificate".
  Ballot SC-097: SHA-1 retirement requirements.

• Source of incident disclosure: Third Party Reported.

Comment 1

[Amaya Espinosa]

We would like to inform you that FNMT revoked the SHA-1 certificate for the “AC Componentes” subordinate certificate on September 21, 2026, and has updated the status information in CCADB.

Additional details and a full incident report will follow by September 29.

Comment 2

[Amaya Espinosa]

Full Incident Report

Summary

• CA Owner CCADB unique ID: A000274
• Incident description: An unexpired SHA-1-signed Subordinate CA certificate remained unrevoked after the September 15, 2026 deadline specified by the applicable TLS Baseline Requirements.
• Timeline summary:
  • Non-compliance start date: 2026-09-15
  • Non-compliance identified date: 2026-09-15
  • Non-compliance end date: 2026-09-21
• Relevant policies: CA/Browser Forum TLS Baseline Requirements section 7.1.3.2.1: "Prior to 2026-09-15, the CA SHALL revoke any unexpired Subordinate CA Certificate that contains RSASSA-PKCS1-v1_5 with SHA-1 within the Certificate".
• Source of incident disclosure: Third party reporter

Impact

• Total number of certificates: 1 (one) intermediate CA certificate
• Total number of remaining valid certificates: 0 following revocation on September 21, 2026
• Affected certificate types: Intermediate CA certificate
• Incident heuristic: The full corpus of affected certificates is disclosed in the Appendix. The affected corpus consists solely of the unexpired SHA-1-signed certificate of the subordinate CA "AC Componentes Informáticos".
• Was issuance stopped in response to this incident, and why or why not?: No. Issuance was not stopped because the incident is limited to the legacy SHA-1-signed certificate of the affected subordinate CA, which was no longer being used for certificate issuance.
• Analysis: The affected Subordinate CA certificate was required to be revoked by September 15, 2026. The certificate was identified as remaining unrevoked after the applicable deadline, and the investigation confirmed that no additional certificates were affected. The affected certificate was subsequently revoked on September 21, 2026.
• Additional considerations: None.

Timeline

All dates are UTC.

• 2026-02-24: Ballot SC-097 was adopted into TLS Baseline Requirements version 2.2.5.
• 2026-03-03: An action was planned to review the affected CA population.
• 2026-09-15 00:00:00 The deadline for revocation of unexpired Subordinate CA Certificates containing RSASSA-PKCS1-v1_5 with SHA-1 passed. The affected certificate remained unexpired and unrevoked. The incident commenced.
• 2026-09-15 15:19: First notification received regarding the affected certificate.
• 2026-09-15 16:42: FNMT became aware of the issue and started to investigate the affected certificate and the scope of the issue.
• 2026-09-15 23:35 Second notification received regarding the affected certificate.
• 2026-09-16 05:41: FNMT confirmed that no additional certificates were affected.
• 2026-09-16 14:59: FNMT responded to the first notification.
• 2026-09-17: FNMT notified customers that the affected certificate would be revoked.
• 2026-09-17 07:12: FNMT responded to the second notification.
• 2026-09-17 14:44: An additional third-party notification was received regarding the affected certificate.
• 2026-09-17 19:31: FNMT opened a Bugzilla bug to report the incident.
• 2026-09-17 19:44: FNMT responded to the additional third-party notification.
• 2026-09-21 11:12:09: FNMT The affected certificate was revoked, resolving the incident.

Related Incidents

Bug	Date	Description
2072663	2026-09-16	Both bugs involve a failure to revoke an unexpired SHA-1-signed subordinate CA certificate within the timeframe required by the applicable BRs.

Root Cause Analysis

The incident resulted from the affected legacy SHA-1-signed Subordinate CA certificate not being identified for revocation within the required timeframe.
The organization was aware of the SHA-1 deprecation requirements and had identified the need to review the CA population to determine which CAs were subject to the applicable requirements. However, the assigned review action was not carried out, and the process did not ensure effective follow-up and verification of its completion before the applicable deadline.
Two related contributing factors are identified below.
Contributing Factor No. 1: The Affected Subordinate CA Certificate Was Not Identified During the Required Review

• Description: In March 2026, the need to review the CA population to determine which CAs were affected by the SHA-1 deprecation requirements was identified and assigned. The assigned action was not carried out. As a result, the affected Subordinate CA certificate was not identified as requiring revocation by September 15, 2026.
• Timeline: The review action was identified in March 2026 and remained incomplete through the applicable revocation deadline.
• Detection: The factor was detected during the investigation of the affected certificate's revocation status. Prior to the incident, existing periodic reviews did not detect that the assigned review remained incomplete, allowing the certificate to remain unidentified for revocation.
• Interaction with Other Factors: The incomplete review was not detected because the action was not subject to effective follow-up and completion verification, as described in Contributing Factor No. 2.
• Root Cause Analysis Methodology Used: 5-Whys Analysis.

Contributing Factor No. 2: The Process Did Not Ensure Follow-Up and Verification of the Assigned Action

• Description: The process for managing compliance actions did not ensure that the assigned review action was tracked through completion and that completion was subsequently verified. No follow-up ticket was established, and no confirmation of completion was performed.
• Timeline: The assigned action remained incomplete and without effective follow-up from March 2026 through September 15, 2026.
• Detection: The factor was detected during the investigation. Prior to the incident, the lack of a follow-up ticket and completion verification was not identified through existing periodic reviews, allowing the incomplete action to remain undetected.
• Interaction with Other Factors: The lack of effective follow-up and completion verification allowed the incomplete review to remain undetected, resulting in the affected certificate not being identified for revocation within the required timeframe.
• Root Cause Analysis Methodology Used: 5-Whys Analysis.

Lessons Learned

• What went well: Once the issue was identified, the affected certificate was revoked.
• What didn’t go well: The review of the CA population identified in March 2026 was not completed, and the action was not tracked through completion. As a result, the affected Subordinate CA certificate was not identified for revocation by the applicable deadline.
• Where we got lucky: The affected certificates were not being used for certificate issuance

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Complete the review of the CA population to identify any remaining certificates subject to the SHA-1 deprecation revocation requirements	Corrective	Root Cause #1	The review is completed and any affected certificates are identified and addressed	2026-09-16	Complete
Revoke the affected legacy SHA-1-signed Subordinate CA certificate	Corrective	Root Cause #1	The certificate is revoked and its revocation status is publicly available	2026-09-21	Complete
Establish a formal tracking mechanism for compliance actions identified during CA reviews, including an assigned owner and target completion date	Preventive	Root Cause #2	Identified actions are tracked through completion and their status is confirmed before the applicable deadline.	2026-10-09	Ongoing

Appendix

Descriptions of the affected certificate are included here for ease of human reading, and are also attached as a CSV for machine reading.

Field	Value
Precertificate SHA-256 hash	N/A
Certificate SHA-256 hash	DB0DA16032F1643A2496FDE742E2BBE81DACA58CD7612061420E154CE1BCE2BD
Subject	OU=AC Componentes Informáticos,O=FNMT-RCM,C=ES
Issuer	OU=AC RAIZ FNMT-RCM,O=FNMT-RCM,C=ES
Not before	2013-06-27 14:17:50 GMT
Not after	2028-06-27 14:17:50 GMT
Serial #	0x3E7CFD54CDE5E16D51CC498E1B1ECD48
dNSNames	N/A
Is revoked?	YES
Revocation date	2026-09-21
Revocation reason	4 (superseded)

Comment 3

[Amaya Espinosa]

Attachment: affected_certificate.csv

Comment 4

[Amaya Espinosa]

The implementation of the formal tracking mechanism is progressing well. Some additional time is needed to ensure the process is properly defined and implemented. The target completion date has been updated to 29 October 2026.

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Complete the review of the CA population to identify any remaining certificates subject to the SHA-1 deprecation revocation requirements	Corrective	Root Cause #1	The review is completed and any affected certificates are identified and addressed	2026-09-16	Complete
Revoke the affected legacy SHA-1-signed Subordinate CA certificate	Corrective	Root Cause #1	TThe certificate is revoked and its revocation status is publicly available	2026-09-21	Complete
Establish a formal tracking mechanism for compliance actions identified during CA reviews, including an assigned owner and target completion date	Preventive	Root Cause #2	Identified actions are tracked through completion and their status is confirmed before the applicable deadline	2026-10-29	Ongoing

FNMT will continue to monitor this thread and address any questions. Please set the Next Update field to 2026-10-22 so we can provide a further progress update on this action item. Thank you.