DigiCert: Non-audited, non-technically-constrained intermediate certificates

The case concerns CCADB findings that certain intermediate certificates in the “Belgium Root CA*” hierarchies are not audited and are not technically constrained. DigiCert reported that audit statements for the “Belgium Root CA*” hierarchies had been received, and that it was waiting for the audit statements to be provided online or via Bugzilla so the corresponding CCADB records could be updated. DigiCert noted that the ABB and Eurida certificates are technically constrained but did not meet the Baseline Requirements in the area discussed (ABB’s IPv6 constraint was incorrect, and Eurida lacked an EKU despite being name constrained). DigiCert stated that it granted an exception for both ABB and Eurida by checking the “...Same as Parent” boxes and recording the exception in the Comments field to stop related notifications. The thread also states that ABB and NET Norway (Eurida) were being worked with to sunset the two CAs that do not have recent audits, and that both CAs had ceased issuance and were in a sunsetting period. A WebTrust seal/report link and an audit report were shared for CCADB upload, and the thread ends with a “Thanks!” confirmation.

1. 2017-05-26 Bug opened regarding CCADB-listed intermediate certificates that were not audited and not technically constrained.
2. 2017-05-31 DigiCert received audit statements and granted exceptions for ABB and Eurida to address Baseline Requirements issues.
3. 2017-06-21 WebTrust seal/report and an audit report were shared for CCADB upload.
4. 2017-06-22 An audit report attachment was created for the Belgian Government CA point-in-time audit.
5. 2017-07-13 Thread concluded with a confirmation message.

1. 2017-05-26 Community commenter — Kathleen Wilson listed specific intermediate certificates that, per CCADB, were not audited and not technically constrained.
2. 2017-05-31 Community commenter — Kathleen Wilson said audit statements were received and that DigiCert was waiting to update CCADB records, then granted exceptions for ABB and Eurida by using the “...Same as Parent” boxes and documenting the exception.
3. 2017-05-31 Community commenter — Ben Wilson stated DigiCert was working with ABB and NET Norway (Eurida) to sunset the two CAs, agreeing with the exception decision and noting the CAs had ceased issuance and were in a sunsetting period.
4. 2017-06-21 Community commenter — Stephane Mans shared a WebTrust seal/report link and said the audit report was available for CCADB upload.
5. 2017-06-22 Community commenter — Stephane Mans created an attachment containing the Belgian Government CA point-in-time audit report.
6. 2017-07-13 Community commenter — Kathleen Wilson replied “Thanks!”