TrustAsia: CAA Mis-Issuance
Categories
(CA Program :: CA Certificate Compliance, task)
Tracking
(Not tracked)
People
(Reporter: Ca.mail, Unassigned)
Details
Preliminary Incident Report
Summary
-
Incident description:
On October 16, 2026, TrustAsia received a Certificate Problem Report from a third party stating that TrustAsia had issued certificates for domains whose CAA records explicitly prohibited issuance by TrustAsia.
Our initial investigation confirmed that all affected certificates are DV certificates issued using DNS-based domain validation. Under certain conditions, the issuance workflow incorrectly associated CAA lookup results obtained for a parent domain with a subdomain, resulting in the CAA check for that subdomain not being performed correctly.
After identifying the issue, we immediately suspended certificate issuance using DNS-based domain validation. We resumed issuance after remediating the defect that caused parent-domain CAA check results to be incorrectly referenced when processing requests for subdomains and verifying the remediation in production.
At the time of publication, the affected certificate list contains 19,237 certificate records, and the corresponding certificates have all been revoked. The investigation is ongoing, and we will publish a Full Incident Report within 14 days of publishing this Preliminary Incident Report.
-
Relevant policies:
- CA/Browser Forum TLS Baseline Requirements v2.3.1, Section 4.2.2.1
- TrustAsia Global CP&CPS v2.2.0, Section 4.2.2.1
-
Source of incident disclosure:
Third Party Reported
Description
•