ETSI Audit of MULTICERT
This case concerns MULTICERT providing audit-related documentation to Mozilla. The bug was created with attachments described as audit certificates for MULTICERT issued on 28 December 2017. A Mozilla participant asked what value these certificates had to Mozilla because they appeared to provide little of the information required in audit statements and less than what Mozilla had on record for MULTICERT in another bug. MULTICERT responded that it was obtaining a conformity statement that would include the CA thumbprint and other information, and noted that the Portuguese Trust Service List had included MULTICERT as eIDAS qualified earlier in the year, with more information to come. The assigned Mozilla CA Program representative later closed the bug, stating it may continue to be used for uploading annual audit statements for this CA. An additional attachment was created later: an audit letter listing the CAs covered by the ETSI audit.
- MULTICERT audit certificates referenced in the bug were issued.
- Bug 1433320 was created with attachments for MULTICERT ETSI audit certificates.
- Mozilla closed the bug while indicating it could continue to be used for annual audit statement uploads.
- An additional ETSI audit letter attachment was added listing CAs covered by the audit.
- Community commenter — Created attachments for MULTICERT audit certificates (DTW2017.001, DTST2017.001, DTSE2017.001, DTAE2017.001) issued 28 December 2017.
- Fastly representative — Asked what value the provided certificates had to Mozilla because they seemed to include almost none of the required audit-statement information.
- Community commenter — Explained MULTICERT was obtaining a conformity statement including the CA thumbprint and other helpful information, and referenced MULTICERT being listed as eIDAS qualified on the Portuguese Trust Service List.
- Mozilla representative — Closed the bug, noting it may continue to be used for uploading annual audit statements for MULTICERT.
- Community commenter — Created an additional attachment: an audit letter listing the CAs covered by the ETSI audit.