Entrust: Outdated audit statement for LAWtrust intermediate certificate and related RA audit concerns

This case concerned an outdated audit statement for Entrust’s LAWtrust intermediate certificate, which was flagged by Mozilla after CCADB showed the audit statement was overdue. Mozilla also noted a bounced CCADB contact email for Entrust. Entrust said the audit had been completed, but the final report was delayed by the auditor; later, the report was delivered and entered into CCADB. The thread then expanded into questions about a WebTrust note that LAWtrust did not maintain evidence that subscriber information was properly authenticated by external Registration Authorities, and Entrust explained that it would either rely on a WebTrust exception or have the constrained RAs audited. Entrust also said it would increase project management for third-party sub-CAs, require audit plans and timely delivery, and ask for an auditor letter if a report is late. The bug was resolved as fixed, and a later comment stated that all questions had been answered and remediation was complete.

1. 2019-04-02 CCADB flagged LAWtrust’s intermediate audit statement as outdated.
2. 2019-07-09 LAWtrust’s audit report was delivered.
3. 2019-08-30 Entrust filed an incident report describing the late audit report and its remediation steps.
4. 2020-01-21 Mozilla stated that all questions had been answered and remediation was complete.

1. 2019-05-07 Mozilla representative — Mozilla asked Entrust to update the CCADB record for the LAWtrust intermediate and provide an incident report for the overdue audit statement.
2. 2019-05-10 Entrust representative — Entrust said the audit was complete and the final report was expected in one to two weeks, and it would investigate the email alias issue.
3. 2019-07-25 Fastly representative — Mozilla confirmed the audit was in CCADB and asked Entrust to explain a finding about subscriber authentication evidence and its response.
4. 2019-08-30 Entrust representative — Entrust submitted an incident report timeline and said it would improve project management for third-party intermediate CAs.
5. 2019-09-10 Community commenter — Mozilla requested the RA charters and questioned Entrust’s handling of audit oversight and remediation.
6. 2019-09-10 Entrust representative — Entrust attached multiple RA charters and said it would add quarterly communication and audit-planning deliverables.
7. 2019-10-16 Entrust representative — Entrust said LAWtrust was working with auditors either to use a WebTrust exception or to audit the constrained RAs.
8. 2019-10-16 Community commenter — Mozilla set Needs-Info and asked for weekly progress updates.
9. 2019-10-28 Entrust representative — Entrust said it would improve audit project management and either obtain the exception or audit the constrained RAs.
10. 2020-01-21 Fastly representative — Mozilla said all questions had been answered and remediation was complete.