Visa: Qualified Audit Statements

This case concerns qualified statements in Visa’s WTCA/WTBR audit submissions referenced from bug 1485777. The initial request asked Visa to address qualifications in the WTBR report, including instances where domain validation evidence was not found for certain certificates, and to provide an incident report describing the misissuances and remediation plan, as well as why the audit statements were delivered about two months late. Visa responded that it restored access to its historical tracking system and was reviewing the listed items, then provided a detailed response describing issues found in the audit reports and remediation steps. Visa stated that for one WTBR qualification (2-4.1), it was unable to obtain domain validation evidence for 5 of 45 certificate issuance requests selected, and it provided additional details for other audit findings, including an EKU field issue for one certificate and plans to replace the certificate with a corrected one. Visa also indicated that the root is being removed from the program via bug 1493822. The bug is marked RESOLVED with resolution FIXED.

1. 2018-08-24 Visa submitted qualified WTCA/WTBR audit statements in relation to the referenced audit findings.
2. 2018-08-29 Visa reported restoring access to its historical tracking system and preparing a detailed response.
3. 2018-09-17 Visa provided a detailed response addressing audit qualifications and remediation steps.
4. 2018-09-22 Visa stated an EKU-related issue was due to a legacy profile and that the profile/template was corrected, with plans to replace the affected certificate.
5. 2018-10-03 Visa noted the root was being removed from the program via bug 1493822.

1. 2018-08-24 Fastly representative — Wayne Thayer requested an incident report and remediation details for qualifications in the WTCA/WTBR audit statements, including misissuance-related items and missing domain validation evidence, and asked why the statements were delivered almost two months late.
2. 2018-08-29 Visa — PKI Policy apologized for the delay, said historical tracking access was restored, and stated Visa was preparing a detailed response.
3. 2018-09-17 Visa — Visa provided a detailed response describing subscriber context and stating that issues identified to date were addressed and resolved, including revocation-related and domain validation-related audit findings.
4. 2018-09-22 Visa — Visa stated an EKU field issue affected one issuance due to a legacy profile, said the certificate was not used as a web server certificate, and said Visa planned to replace it with a corrected certificate.
5. 2018-09-23 Tds representative — A commenter asked Visa to clarify the date the profile was corrected.
6. 2018-09-25 Visa — Visa clarified that the EKU profile/template was corrected as of August 23, 2017 and referenced another bug for the correction.
7. 2018-10-03 Fastly representative — Wayne Thayer stated that the root is being removed from the program via bug 1493822.