CCADB Update - CCADB ID replacement and new AllCertificateRecords REST API

[CCADB Support]

All,

On July 30, 2026, the CCADB will update, introducing a new REST API version of the AllCertificateRecords report and changing how we expose CCADB IDs.

We plan for the CCADB to be unavailable to CA Owners from July 30, 2026, at approximately 08:00 PM PT, until July 31, 2026, at approximately 10:00 AM PT.

Our intention is to:

1. Replace "CCADB Record ID" with "CCADB Unique ID".
   To improve data security and align with best practices, we are replacing the internal Salesforce CCADB Record ID with the CCADB Unique ID. While a Salesforce Record ID does not expose sensitive data on its own, using the CCADB Unique ID (an External ID specifically designed for integrations) provides a more secure approach to data sharing. These changes apply to:

   • All applicable public reports. In those reports, the CCADB Record ID column will be replaced with the CCADB Unique ID.

   • All APIs. Specifically, in the CertificateInformation object in the response JSON, the SalesforceRecordId field will be renamed to CCADBUniqueId.

Action Required: Consumers of external reports and related APIs will need to update their integrations to parse and rely on the "CCADB Unique ID" globally instead of the “CCADB Record ID”.

2. Launch the AllCertificateRecords REST API V1.
   We are deploying the new AllCertificateRecords REST API V1 (POST /services/apexrest/v1/allcertificaterecords). This endpoint provides an efficient, read-only JSON interface for querying root and intermediate certificate records. Key features of the new API include:

   • Dynamic Payloads (Field Sets): Base requests return a fast, lightweight core payload (identity, validity, revocation, and root store statuses). Clients can optionally request additional blocks of data (e.g., AuditInformation, Capabilities, NonAuditDocumentInformation, and CRL/ACME details) dynamically using the fieldSets array.

   • Robust Pagination & Filtering: To ensure fast retrieval and optimize platform memory, queries mandate dataset partitioning using notBeforeYear or notBeforeDecade filters, paired with a configurable offset-based pagination system.

When released in production, detailed documentation will be available on https://github.com/mozilla/CCADB-Tools/tree/master/. Meanwhile, we invite anyone to test the AllCertificateRecordsAPI in our sandbox environment and please be mindful that the data in this environment lags behind production and may not be accurate. 

We will send a copy of this message to all CA Owners in the CCADB and plan to send another message here upon completion of the update. 

Thank you,

- CCADB Support

[Corey Bonnell]

Hello,

Will the CSV-based Version 5 of the AllCertificateRecords report still be available for the foreseeable future, or should consumers plan to migrate to the REST-based API soon?

Thanks,

Corey

[Arman Asemani]

Hi Corey,

Yes and yes.

The CSV-based Version 5 of the AllCertificateRecords report will be hosted on ccadb.org until technical file constraints are reached. A not precise limit would be 15,000 rows in the file. The file currently has approximately 10,200 rows, so we anticipate at least a few months run rate barring unusual growth in the number of certificates or the number of characters included in CRL related fields that can be 0 characters or well over 1,000.

Approaching the size limits is not imminent, but it is inevitable so we hope consumers of the report consider migration to the REST-based API sooner than later. Early adoption will also allow early feedback to the CCADB on the API while the AllCertificateRecords report remains as a fallback.

Thank you,

Arman