2084949 - NETLOCK: Precertificates issued by Precertificate Signing CA after 2026-03-15

Status: ASSIGNED

(CA Program :: CA Certificate Compliance, task)

Description

[Roland]

Preliminary Incident Report

Summary

• Incident description: On 2026-10-20 at 23:10:34 UTC, NETLOCK DVSSL CTCA, a Technically Constrained Precertificate Signing CA subordinate to NETLOCK DVSSL CA, signed a precertificate (serial 6130e37b12220984ad51bb6118ce, CN=revoked.dv.tanusitvany.hu), which was logged to Google Argon 2026h2. Since 2026-03-15, the TLS Baseline Requirements prohibit the use of Precertificate Signing CAs to issue Precertificates. NETLOCK has confirmed the finding. The full population of affected precertificates issued by this CA since 2026-03-15 is being determined and will be reported in the Full Incident Report.
• Relevant policies: TLS Baseline Requirements, Section 7.1.2.4 (Technically Constrained Precertificate Signing CA Certificate Profile), as amended by Ballot SC-092 (effective 2026-03-15); Section 1.2.2 (Relevant Dates); Mozilla Root Store Policy, Section 2.3.
• Source of incident disclosure: Third Party Reported – Certificate Problem Report received on 2026-10-21.

Comment 1

[[:Levente@Netlock]]

Hello,

NETLOCK received this report 2026-10-21 20:15 UTC. We confirm NETLOCK DVSSL CTCA is CA:TRUE with EKU limited to id-kp-ctPrecertificateSigning, and are verifying the 2026-10-20 23:10:34 UTC precertificate (serial 6130e37b12220984ad51bb6118ce) against our issuance logs.

Levente