DocuSign Audit Statements

This case tracks DocuSign’s submission of audit attestation statements for multiple DocuSign root certificates included in NSS. The CA initially provided an attestation PDF that covered several roots (Certplus Root CA G1/G2 and OpenTrust Root CA G1/G2/G3), and Kathleen Wilson noted she could not confirm whether the “Class 2 Primary CA” root included in NSS was covered by that attestation. Kathleen later reported receiving an email update that the audit of the “Class 2 Primary CA” and its subCAs completed in October, and that DocuSign was waiting for the auditor’s attestation letter. Erwann Abalea then uploaded a new attestation for the “Certplus Class 2 Primary CA” root received from the auditor, and Kathleen confirmed the auditor’s email that the attached statement was a valid audit attestation provided by LSTI. The bug was closed as RESOLVED, with Kathleen stating it may continue to be used for tracking the CA’s annual audit statements. A further “New attestation 2017” was later attached by Erwann.

1. 2016-08-22 DocuSign submitted an audit attestation PDF covering several NSS-included DocuSign roots.
2. 2016-11-14 DocuSign reported the “Class 2 Primary CA” audit completed and was awaiting the auditor’s attestation letter.
3. 2017-03-20 DocuSign received and uploaded the auditor’s attestation for the “Certplus Class 2 Primary CA” root.
4. 2017-03-21 The auditor attestation was confirmed as valid and the bug was closed, with note it may be reused for annual audit tracking.
5. 2017-10-09 DocuSign uploaded a new 2017 attestation.

1. 2016-08-22 Docusign representative — Created an attachment with an Attestation-V2 PDF, stating it complements CAs listed under bug #1025095 and bug #335392.
2. 2016-08-22 Mozilla representative — Checked which NSS-included roots were covered by the attestation and said she could not ascertain whether the “Class 2 Primary CA” was covered.
3. 2016-11-14 Mozilla representative — Reported receiving an email update that the “Class 2 Primary CA” audit completed in October and DocuSign was waiting for the auditor’s attestation letter.
4. 2017-02-07 Mozilla representative — Asked Erwann for an update on the audit statement for the “Class 2 Primary CA.”
5. 2017-03-20 Docusign representative — Created an attachment with the auditor’s attestation for the “Certplus Class 2 Primary CA” root.
6. 2017-03-21 Mozilla representative — Confirmed she received an auditor email stating the attached audit statement is a valid attestation provided by LSTI.
7. 2017-03-21 Mozilla representative — Closed the bug, noting it may continue to be used for tracking this CA’s annual audit statements.
8. 2017-10-09 Docusign representative — Created an attachment for a new 2017 attestation.