CFCA: Missed annual CPS update publication on website in 2018

This case concerns China Financial Certification Authority (CFCA) missing the annual publication of an updated Certification Practice Statement (CPS) on its website in 2018. CFCA stated that it maintained annual updates to its Global Trust CPS as requested by Mozilla and Google, but that major business adjustments in 2018 (including stopping code signing in March 2018 and revoking subordinate CAs in October 2018) delayed updating the CPS from version 3.3 to version 4.0, resulting in the missed 2018 publication. In response to Mozilla’s questions, CFCA said it became aware of the failure in December 2018 and that it was not familiar with the reporting mechanism until it was reminded, after which it submitted the report. CFCA later stated that the CPS was published on August 9 and provided a link to the updated CPS document. Mozilla’s reviewer noted the delay and the lack of notification about the publication delay, and then resolved the bug after stating that remediation appeared complete. The bug was marked FIXED and the thread indicates the updated CPS publication was completed.

1. 2018-10-01 CFCA revoked subordinate code signing CAs (CFCA EV CodeSign OCA and CFCA OV CodeSign OCA).
2. 2018-12-01 CFCA identified that it had not published the required annual CPS update.
3. 2019-08-09 CFCA published version 4.0 of its Global Trust CPS on its website.

1. 2019-07-12 Community commenter — Created the bug and explained that business changes in 2018 delayed updating CPS from V3.3 to V4.0, leading to the missed 2018 annual publication.
2. 2019-07-13 Fastly representative — Asked Oliver to remove the security-sensitive flag from the bug.
3. 2019-07-15 Fastly representative — Requested CFCA update its answers to clarify how CFCA discovered the violation and challenged whether the current CPS complied with the BRs.
4. 2019-07-31 Community commenter — Responded that CFCA became aware of the issue due to major business adjustments and described internal document compilation/approval timing and future controls to prevent delays.
5. 2019-08-10 Fastly representative — Asked whether the new CPS had been published and criticized the lack of notification and the time taken to publish.
6. 2019-08-13 Community commenter — Stated CFCA became aware in December 2018, said it was reminded about the reporting mechanism, and reported that the CPS was published on August 9 with a provided URL.
7. 2019-08-13 Fastly representative — Acknowledged remediation appeared complete, expressed concerns about the delay and notification failure, and resolved the bug.
8. 2019-08-15 Community commenter — Acknowledged the mistake, apologized, and said CFCA would solve related problems timely.