Asseco DS / Certum: inconsistent disclosure of externally-operated intermediate

Asseco Data Systems S.A. (Certum) reported an inconsistency regarding the disclosure of an intermediate certificate that was cross-certified with SSL.com. The issue arose when it was found that the same Subject Public Key Info (SPKI) was associated with different Certificate Policy/Certification Practice Statements (CP/CPS) from both Certum and SSL.com. Following the report, Certum acknowledged the discrepancy and committed to reviewing their disclosures. They subsequently corrected the audit information for the affected certificates and confirmed that no further inconsistencies were found in their intermediate certificates. The case has been resolved with the necessary updates made.

1. 2019-07-18 Asseco disclosed an inconsistency in the CP/CPS information for a cross-certified intermediate certificate.
2. 2019-08-01 Asseco corrected the audit information for the affected certificates.
3. 2019-08-09 Asseco confirmed no additional inconsistencies were found in their intermediate certificates.

1. 2019-07-18 Mm representative — Asseco has disclosed the following intermediate as being operated under the same CP/CPS as parent.
2. 2019-07-19 Asseco Data Systems S.A. — Thank you for reporting this. We will inspect it and share our point of view soon.
3. 2019-08-01 Asseco Data Systems S.A. — We fixed issues reported by crt.sh and set subject audit/CP/CPS information instead of issuer.
4. 2019-08-09 Fastly representative — It appears that all questions have been answered and remediation is complete.