CCADB Update: New Example Certificates feature on Add/Update Root Request cases

[Dustin Hollenback]

All,

On 2026-06-23, the CCADB will be updated to introduce a new Example Certificates feature on the Add/Update Root Request case. This feature lets a CA Owner submit one example end-entity certificate for each certificate profile that applies to a Root CA hierarchy, organized by certificate type.

The CCADB will be unavailable to CA Owners on 2026-06-23, from approximately 08:00 PM until approximately 11:59 PM Pacific Time.

Our intention is to:

• Add a new EXAMPLE CERTIFICATES tab to the Add/Update Root Request case, alongside the existing CA OWNER, AUDITS, NON-AUDIT DOCUMENTS, ROOT INFORMATION, and TEST WEBSITES tabs.
• For each Root CA certificate on the case, pre-build a checklist of the certificate profiles that apply to the Root CA certificate's Trust Bits, grouped by certificate type (TLS, S/MIME, Code Signing, Mark Certificates, and Other). The CA Owner pastes one example certificate (PEM) into each applicable profile slot, or marks the profile Not Issued.
• Automatically validate each submitted certificate against its profile: the issuer must chain to an intermediate within the Root CA's hierarchy; the certificate's policy OID must match the profile's expected OID; and for profiles that share a policy OID (the EV TLS sub-types and the Mark Certificate types) the businessCategory or markType subject field must match.
• Track each slot with an explicit status of Pending, Submitted, or Not Issued, so a CA Owner that has not yet responded is distinguishable from a CA Owner that has confirmed it does not issue a profile.
• Stage submitted examples on the case during review. Once a Root Store reviewer approves the case, the examples are promoted to the corresponding Root Certificate record, where they are visible read-only to all authenticated CCADB users.

This is a separate feature from Test Websites, which is not changing. Test Websites checks the live TLS chain and revocation behavior for a root. Example certificates let a CA Owner show how the certificates it issues for each profile are structured.

Detailed instructions are in the Example Certificates User Guide.

We will send a copy of this message to all CA Owners in the CCADB and plan to send another message here upon completion of the update.

Best regards,

Dustin, on behalf of the CCADB Steering Committee