Consorci AOC audit statements needed correction for coverage dates, timing, and fingerprint details
This case concerned Consorci AOC’s audit statements for its CA operations, which Mozilla reviewers found had problems with audit coverage dates, submission timing, and public audit information details. The CA said it first became aware of the issue through a CCADB reminder and discussions with auditors, and it then ordered additional audits and later provided revised reports. Mozilla asked for clarification because the submitted audit periods were not contiguous, the reports were provided more than three months after the audit period end date, and the statements did not include SHA-256 fingerprints for each root. Consorci AOC explained that date errors had been propagated from earlier drafts, that the audit period was shortened during its transition from WebTrust to eIDAS/ETSI-style audits, and that the SHA-256 fingerprint issue was still under discussion with ENAC. The CA later uploaded corrected 2018 reports and English translations, and said the dates and deadlines were now clear to both the CA and its auditors. The bug was resolved as FIXED, and Mozilla later noted that the revised reports still left a gap in audit coverage from 2016-12-20 to 2017-06-18, with no further remediation possible for that gap.
- Audit coverage gap began between the prior and later audit periods.
- Consorci AOC opened the case and attached audit-related documents.
- Consorci AOC uploaded 2017 and 2016-2017 audit reports.
- Consorci AOC uploaded 2018 audit documents and Mozilla raised concerns about timing, gaps, and fingerprint requirements.
- Consorci AOC uploaded corrected 2018 audit reports and English translations.
- Mozilla closed the incident after noting the remaining audit coverage gap could not be remediated.
- Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) — Francesc Ferrer opened the bug and attached audit and policy documents, describing a gap in audit coverage and stating that a new audit was being ordered.
- Fastly representative — Wayne Thayer asked for the status of the new audits.
- Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) — Francesc Ferrer said the new estimated delivery date for the audits was 2018-03-15.
- Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) — Francesc Ferrer uploaded multiple qualified audit reports and said the reports were provided.
- Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) — Francesc Ferrer asked for the EV audit dates to be updated in CCADB.
- Mozilla representative — Kathleen Wilson noted that the root certificate in the audit statements did not match the certificate in CCADB.
- Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) — Francesc Ferrer uploaded revised audit reports and said the new documents had the correct hashes for the listed roots.
- Mozilla representative — Kathleen Wilson asked the CA to file a new CCADB audit case for the new audit statements.
- Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) — Francesc Ferrer said CCADB cases #00264 and #00265 had been created and asked for the correct dates to be set.
- Mozilla representative — Kathleen Wilson said the cases were done and processed and asked the CA to ensure test websites worked before submitting the 2018 audit case.
- Fastly representative — Wayne Thayer asked for English-language versions and questioned why the reports were submitted more than three months after the audit period ended.
- Mozilla representative — Kathleen Wilson recorded CCADB comments asking for an explanation of the late submission, the audit gap, and missing Mozilla-required public audit information.
- Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) — Francesc Ferrer explained the timing misunderstanding, the date error propagated from earlier drafts, and that auditors would issue a new statement urgently.
- Mozilla representative — Kathleen Wilson asked follow-up questions about the shortened audit period and the delay in receiving the draft report.
- Community commenter — Ryan Sleevi said the SHA-256 fingerprint issue was concerning and should be addressed in a way that preserves Mozilla’s audit requirements.
- Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) — Francesc Ferrer said the CA was working closely with auditors and expected a new Spanish version by the end of the next week.
- Mozilla representative — Kathleen Wilson asked for an update.
- Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) — Francesc Ferrer said new reports would be attached the following Monday.
- Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) — Francesc Ferrer uploaded corrected original reports and sworn English translations and said the deadlines and audit dates were now aligned.
- Fastly representative — Wayne Thayer said the revised reports still left a gap in audit coverage from 2016-12-20 to 2017-06-18 and closed the incident.