All,
The CCADB update to streamline audit document handling, automate status
tracking across certificate hierarchies, expand trust bit support, and
improve the Add/Update Root case workflow is now complete. CA Owner access
to the CCADB has been restored.
This update:
- Unified the Audit Document file download process with the Non-Audit
Document download process across both Root and Intermediate certificate
records. The download process also accepts .md and .asciidoc files
alongside standard audit formats. The download service supports up to 5 URL
redirects, a maximum file size of 12 MB, and a 2-minute (120-second)
timeout. File downloads will take approximately 1-2 minutes to process in
the background. Once complete, refreshing the record page will display the
associated Audit Document records, and any file download errors will appear
in the "Message" section.
- Replaced the previous hourly batch job for Root Store Status with
real-time, automated propagation for Intermediate certificate records.
Apple Root Status, Microsoft Root Status, Mozilla Root Status, and Apple CA
Owner Status now automatically copy from the parent Root certificate to all
Intermediate certificate records upon creation. Updating an Intermediate
certificate's parent CA Owner or certificate (moving an Intermediate
certificate under a different Root certificate) or changing the Root Store
Status on a Root certificate automatically propagates the updated statuses
down through all child Intermediates in the hierarchy.
- Added support for "Brand Indicator for Message Identification" (BIMI)
across trust bit settings and derived trust calculations. We added "Brand
Indicator for Message Identification" to the Associated Trust Bits field
(ordered after "Code Signing") and added Apple Status BIMI mapping while
updating the Intermediate certificate DTB calculation logic to account for
BIMI.
- Improved the Add/Update Root Request case UI for `Example
Certificates`. We added contextual information ("i") tooltips across fields
on the Example Certificate tab in Add/Update Root cases to provide clearer
guidance on required certificate profile attributes.
This update also switched the source for evaluating `$_Capable` flags from
Derived Trust Bits to Transitive Trust fields. This ensures intermediate
certificates chaining to an un-included self-signed root that is
cross-signed by a trusted root (sharing the same Subject + SPKI) are
correctly flagged as $_Capable = True without requiring CA Owners to
manually reparent certificate records in the CCADB. The `$_Capable` flags
appear in places like the CA Reports > CA Hierarchy report and the
AllCertificateRecordsReport.
Please continue to contact CCADB Support ([email protected]) with any
questions regarding the CCADB.
Best regards,
-CCADB Support
On Friday, August 28, 2026 at 8:39:00 AM UTC-4 CCADB Support wrote:
> All,
>
> On September 3, 2026, we will deploy several updates to the CCADB to
> streamline audit document handling, automate status tracking across
> certificate hierarchies, expand trust bit support, and improve the
> Add/Update Root case workflow.
>
> The CCADB will be unavailable to CA Owners from September 2, 2026, at
> approximately 08:00 PM PT, until September 3, 2026, at approximately 10:00
> AM PT.
>
> This update intends to:
>
> - Unify the Audit Document file download process with the Non-Audit
> Document download process across both Root and Intermediate certificate
> records. The download process will also accept .md and .asciidoc files
> alongside standard audit formats. The download service will support up to
> 5
> URL redirects, a maximum file size of 12 MB, and a 2-minute (120-second)
> timeout. File downloads will take approximately 1-2 minutes to process in
> the background. Once complete, refreshing the record page will display the
> associated Audit Document records, and any file download errors will be
> presented in the "Message" section.
> - Replace the current hourly batch job for Root Store Status with
> real-time, automated propagation for Intermediate certificate records.
> Apple Root Status, Microsoft Root Status, Mozilla Root Status, and Apple
> CA
> Owner Status now automatically copy from the parent Root certificate to
> all
> Intermediate certificate records upon creation. Updating an Intermediate
> certificate's parent CA Owner or certificate (moving an Intermediate
> certificate under a different Root certificate) or changing the Root Store
> Status on a Root certificate will automatically propagate the updated
> statuses down through all child Intermediates in the hierarchy.
> - Add support for "Brand Indicator for Message Identification" (BIMI)
> across trust bit settings and derived trust calculations. We will add
> "Brand Indicator for Message Identification" to the Associated Trust Bits
> field (ordered after "Code Signing") and add Apple Status BIMI mapping
> while updating the Intermediate certificate DTB calculation logic to
> account for BIMI.
> - Improve the Add/Update Root case UI for Example Certificates. We
> will add contextual information ("i") tooltips across fields on the
> Example
> Certificate tab in Add/Update Root cases to provide clearer guidance on
> required certificate profile attributes.
>
> We will send a copy of this message to all CA Owners in the CCADB and plan
> to send another message here upon completion of the update.
>
> Best regards,
> -CCADB Support
>
--
You received this message because you are subscribed to the Google Groups
"CCADB Public" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/a/ccadb.org/d/msgid/public/360aa2eb-6db0-43aa-a1c7-6ecbcda6d37bn%40ccadb.org.
