Camerfirma: Missing audit/disclosure for intermediate certificates
Wayne Thayer (Fastly) reported that Camerfirma had not disclosed required audit information in the Common CA Database (CCADB) for an intermediate certificate that chains up to a Mozilla-program root and is capable of issuing S/MIME certificates but is not name constrained, as required by Mozilla root store policy section 5.3. The report also noted that two additional intermediate certificates with CN="MULTICERT SSL Certification Authority 001" were issued and were not disclosed within 7 days, and that one of them had been revoked but still needed disclosure. Camerfirma provided updated information and an audit certificate, and later posted an incident report describing how the CA became aware of the problem, a timeline of actions, and why disclosure was missed (including a procedure gap and unavailability of the responsible person and backup). Camerfirma stated it had disclosed the certificates on July 31 and described remediation steps, including adding a third point of contact for CCADB disclosure and modifying its procedure. The incident report and follow-up discussion addressed the disclosure failures; the bug is marked RESOLVED with resolution FIXED.
- Mozilla CA Program issue raised regarding missing CCADB audit disclosure for a Camerfirma intermediate certificate.
- A relevant Camerfirma intermediate certificate was issued.
- A second relevant Camerfirma intermediate certificate was issued (and later revoked).
- Camerfirma disclosed the missed intermediate certificates in CCADB.
- Camerfirma posted an incident report and described remediation steps.
- Mozilla reviewer responded that the proposed procedural change did not address the policy requirement timing.
- Fastly representative — Wayne Thayer cited the April 2018 Mozilla CA Communication and asked Camerfirma to add required audit information to CCADB or revoke the intermediate certificate, and to provide an incident report.
- AC Camerfirma, S.A. — Juan Angel Martin said he updated the required information.
- Fastly representative — Wayne Thayer requested the audit report (not just the audit certificate) containing the information listed in Mozilla root store policy section 3.1.4.
- Fastly representative — Wayne Thayer stated that two new intermediate certificates were issued but not disclosed within 7 days, and requested CCADB disclosure plus an incident report explaining why disclosure was missed.
- Fastly representative — Wayne Thayer referenced Camerfirma’s incident report posted in response to the request and summarized its contents (timeline, cause, and remediation steps).
- AC Camerfirma, S.A. — Juan Angel Martin reiterated remediation steps (adding a third CCADB point of contact) and said Camerfirma modified its procedure to not deliver the intermediate certificate until it is disclosed in CCADB.
- Fastly representative — Wayne Thayer replied that the proposed procedural change did not help because the policy requires disclosure within a week of creation.