2081411 - Amazon Trust Services: EV Root Test Web Pages Serve Non-EV (DV) Certificates

Status: ASSIGNED

(CA Program :: CA Certificate Compliance, task)

Description

[Amazon Trust Services]

Incident Report

Amazon Trust Services: EV Root Test Web Pages Serve Non-EV (DV) Certificates

Summary

CA Owner CCADB unique ID: A000300

Incident description: A third party reported that ATS does not host EV test websites as required by Appendix A of the EV Guidelines. ATS has an EV trust bit enabled with the root stores (in CCADB) for our five roots. ATS last issued an EV certificate in 2019 and has not issued EV since; the certificates served on the disclosed test pages are not EV certificates. The affected roots are Amazon Root CA 1 (A002375), Amazon Root CA 2 (A002365), Amazon Root CA 3 (A002356), Amazon Root CA 4 (A002388), and Starfield Services Root Certificate Authority – G2 (A000195).

Timeline summary:

• Non-compliance start date: 2019
• Non-compliance identified date: October 12, 2026
• Non-compliance end date: October 12, 2026

Relevant policies: EV Guidelines, Appendix A.

Source of incident disclosure: Reported by a third party.

Impact

Total number of certificates: This did not impact issued certificates.

Total number of "remaining valid" certificates: N/A

Affected certificate types: N/A. ATS has not issued EV certificates since 2019.

Incident heuristic: N/A

Was issuance stopped in response to this incident, and why or why not?: No. ATS does not issue EV certificates, so there was no issuance to stop.

Analysis: ATS has an EV trust bit enabled with the root stores for five roots but does not issue EV certificates and does not host conforming EV test pages. ATS maintains a process for issuing EV certificates.

Additional Considerations: N/A

Timeline

2019 – ATS stopped issuing EV certificates and removes EV certificates from the test website.

October 12, 2026 – We received a report that we are not hosting EV test websites.

October 12, 2026 – ATS confirmed the finding. ATS notified the root programs of the issue.

Related Incidents

2081155 - SECOM: Incorrect and missing EV TLS test websites in CCADB

Root Cause Analysis

Contributing Factor #1: Missed EV Appendix A Requirements

Description: When ATS stopped issuing EV in 2019 and removed EV certificates from the test website, the EV trust bit enabled with the root stores was not requested to be removed. When deprecating the EV test webpages, ATS reviewed the applicable requirements but did not catch the EV Guidelines Appendix A test-page requirement.

Timeline: Since 2019.

Detection: Reported by third party.

Interaction with other factors: N/A

Root Cause Analysis methodology used: 5-Whys

Lessons Learned

What went well

• N/A

What didn't go well

• During deprecation of the EV test webpages, ATS reviewed the applicable requirements but did not catch the Appendix A test-page requirement.

Where we got lucky

• N/A

Action Items

Action Item	Kind	Corresponding Root Causes	Evaluation Criteria	Due Date	Status
Request removal of EV trust bit	Mitigate	Root Cause #1	Request from the root stores that the EV trust bit is removed for all five roots so they are no longer recognized as EV-capable.	2026-10-13	COMPLETE
Review EV Guidelines	Mitigate	Root Cause #1	Review the EV guidelines for additional gaps.	2026-10-13	COMPLETE

Appendix

N/A

Comment 1

[Amazon Trust Services]

Report Closure Summary

Incident description: Amazon Trust Services had an EV trust bit enabled with the root stores for five roots but did not host EV test websites as required by Appendix A of the EV Guidelines. ATS last issued an EV certificate in 2019 and has not issued EV since.

Incident Root Cause(s): When ATS stopped issuing EV in 2019 and deprecated the EV test webpages, we reviewed the applicable requirements but did not catch the EV Guidelines Appendix A test-page requirement.

Remediation description: We requested retirement of the EV trust bit for all five roots (Amazon Root CA 1, 2, 3, 4, and Starfield Services Root Certificate Authority – G2) so they are no longer recognized as EV-capable by the root stores. Additionally, we reviewed the EV guidelines for additional gaps.

Commitment summary: ATS will continue to review and update our procedures when issues are identified.

All Action Items disclosed in this report have been completed as described, and we request its closure.

Comment 2

[incident-reporting]

This is a final call for comments or questions on this Incident Report.

Otherwise, it will be closed on approximately 2026-10-22.