DigiCert: KPN outdated audit remediation and revocation of affected CAs

This case concerns DigiCert responding to CCADB notifications that KPN CAs had outdated ETSI audit information. DigiCert stated that on November 30, 2018, an ETSI audit for KPN with audit deficiencies was posted, and that on January 20, 2019 DigiCert received “outdated Audit alerts” from CCADB reporting for KPN CAs. DigiCert then reviewed the notifications internally, contacted KPN about missing CAs from the audit, and held conference calls to explain the deficiencies and reinforce policy requirements. DigiCert reported that KPN authorized revocation of three ICAs that were no longer active, and DigiCert revoked those three CAs and posted CRLs on March 19, 2019. DigiCert also described ongoing remediation, including KPN engaging a new auditor (KPMG for Webtrust) and providing an audit engagement letter for Mozilla community release after corrections. DigiCert later updated that it received unqualified audit reports from KPMG completed as of May 31, 2019 and would post them to CCADB; the bug is marked RESOLVED with resolution FIXED.

1. 2018-11-30 An ETSI audit for KPN with audit deficiencies was posted in CCADB.
2. 2019-01-20 CCADB outdated-audit alerts were sent to DigiCert for KPN CAs.
3. 2019-03-19 Three KPN ICAs were revoked and CRLs were posted.
4. 2019-05-31 KPMG completed the audit of KPN CA operations (as of this date).
5. 2019-06-02 DigiCert received unqualified KPMG audit reports and planned to post them to CCADB.

1. 2019-03-26 DigiCert — Opened the bug with a detailed account of how DigiCert became aware of outdated KPN audits via CCADB alerts and the remediation steps taken, including revocation of three no-longer-active ICAs.
2. 2019-03-27 Community commenter — Commented that DigiCert’s proposed remediations could be valuable for policy and communications, emphasizing Root CA responsibility for audit scoping.
3. 2019-03-28 DigiCert — Added an attachment labeled “KPN Audit letter.pdf.”
4. 2019-04-19 Fastly representative — Moved Ryan’s suggestion to a policy issue and set a “next update” date to June 1 based on KPMG’s estimate.
5. 2019-06-02 DigiCert — Updated that unqualified KPMG audit reports were received (completed as of 31-May-2019) and would be posted to CCADB shortly.
6. 2019-06-17 Community commenter — Asked whether anything further was needed on the bug.
7. 2019-06-29 Fastly representative — Provided an audit statement link referenced as an attachment URL.