GoDaddy: cross certificate disclosure to CCADB

GoDaddy reported that, during an investigation into Bugzilla #1567061, it uncovered two cross certificates that were not disclosed to CCADB. GoDaddy stated that it began cross-referencing its internal and external documentation (including CP/CPS and 2018 audit reports for each root, intermediate, and cross certificate operated by Starfield) to confirm accurate reporting. After realizing it did not cross-reference CCADB, GoDaddy identified the two potentially undisclosed cross certificates and verified the issue on August 6, then prepared an incident report and engaged Starfield Governance and Policy Committee for incident review. GoDaddy said this incident did not contain any certificate problems that would require stopping issuance. The bug includes the two certificate identifiers/CT lookup links and states that GoDaddy completed a thorough review of certificates listed in its CP/CPS, audit report, and CCADB, and is working to update both CCADB and its audit reports. The resolution is marked FIXED, and later comments indicate updated audit reports were received and that the 2019 audit reports were submitted and pending verification by the root store.

1. 2019-08-01 GoDaddy began cross-referencing documentation after investigating Bugzilla #1567061 and identified a potential CCADB disclosure gap for two cross certificates.
2. 2019-08-06 GoDaddy verified the CCADB disclosure issue and prepared an incident report for review.
3. 2019-09-04 GoDaddy reported it was working to update audit report seals and update audit reports in CCADB.
4. 2019-09-10 GoDaddy submitted 2019 audit reports, pending verification by the root store.
5. 2020-01-22 A participant reported that failed ALV results appeared corrected and questions were answered.

1. 2019-08-07 GoDaddy — GoDaddy explained it discovered two cross certificates not disclosed to CCADB during an investigation, provided certificate details, and described remediation steps including cross-referencing and updating CCADB/audit reports.
2. 2019-09-04 GoDaddy — GoDaddy said it received updated audit reports and was working to get seals and update the audit reports in CCADB.
3. 2019-09-10 GoDaddy — GoDaddy stated its 2019 audit reports were submitted and were pending verification by the root store.
4. 2020-01-22 Fastly representative — w**********r@fastly.com reported that failed ALV results appeared corrected and all questions had been answered.