DigiCert WebTrust audits and related CA documents

This case was opened by DigiCert to upload WebTrust audit packages and has continued to be used as a repository for audit-related CA documents. In 2019, Mozilla and community participants questioned how DigiCert and its auditor handled disclosure of incidents across overlapping audit periods, including whether some issues were listed in one audit report but not all reports covering the same period. DigiCert said it had disclosed relevant incidents to its auditor, that the reporting format was compliant with WebTrust guidance as understood by the auditor, and that it would include incidents in management assertion letters going forward so they would not be hidden or lost. In early 2020, additional discussion arose after audit reports appeared to contain matters of emphasis or non-compliance items without corresponding Bugzilla incident reports. Mozilla then directed DigiCert to track those items in a separate incident bug, which became Bug 1613505, and DigiCert agreed to move the follow-up there. Since then, this bug has continued to receive uploads of audit packages and related documents, including auditor qualifications, CCADB self-assessments, and most recently a root key generation management document attached in July 2026. The bug remains RESOLVED with WORKSFORME and is still being used as a document-upload location rather than as the active tracker for incident remediation.

1. 2018-04-30 DigiCert opened the case and uploaded 2018 WebTrust independent CPA report packages.
2. 2019-07-18 DigiCert summarized how 31 reported bugs were handled for audit disclosure purposes.
3. 2019-08-22 DigiCert said it would include incidents in management assertion letters going forward.
4. 2020-02-05 Mozilla directed DigiCert to track audit-disclosed non-compliance matters in a separate incident bug, Bug 1613505.
5. 2025-11-26 DigiCert uploaded a CCADB self-assessment document.
6. 2026-07-13 DigiCert uploaded a root key generation management document.

1. 2018-04-30 DigiCert — Opened the bug and attached multiple 2018 independent CPA report packages.
2. 2018-05-10 Mozilla representative — Closed the bug but said it could continue to be used for uploading annual audit statements for this CA.
3. 2019-07-11 Community commenter — Asked DigiCert to identify which incident bugs were in scope of the audit and explain omissions from management assertions and reports.
4. 2019-07-18 DigiCert — Said 31 bugs were reviewed and explained which were included in audit reports, disclosed to auditors, or not disclosed.
5. 2019-08-17 DigiCert — Said DigiCert's auditor had sought WebTrust guidance and believed the level of public reporting was compliant with WebTrust standards.
6. 2019-08-19 DigiCert — Confirmed that findings could appear on at least one but not all reports covering the relevant period.
7. 2019-08-22 DigiCert — Said DigiCert would include incidents in the main management assertion letter going forward.
8. 2020-01-31 Community commenter — Raised concern that audit attachments disclosed non-compliance items without corresponding Mozilla incident bugs.
9. 2020-02-05 DigiCert — Posted a management response to matters of emphasis and said all but one item had been closed.
10. 2020-02-05 Community commenter — Asked DigiCert again to open new bugs for those matters and then opened Bug 1613505 to track the discussion separately.
11. 2020-02-06 DigiCert — Acknowledged that follow-up discussion would be carried over to the new bug.
12. 2025-11-26 DigiCert — Attached a DigiCert CCADB self-assessment document.
13. 2026-07-13 DigiCert — Attached a DigiCert root key generation management document.