DigiCert: Apple: Unconstrained intermediate CAs not included in WTBR report

Apple reported an incident involving its Apple IST CAs 5, 6, and 7 not being included in an amended WebTrust Principles and Criteria for Certification Authorities - SSL Baseline with Network Security (WTBR) report for the 16-April-2018 to 15-April-2019 audit period. The issue was triggered when Apple’s root provider, DigiCert, notified Apple on 25-July-2019 that these non-constrained CAs needed to be included in the WTBR report to comply with Mozilla Root Store Policy audit requirements. Apple stated that no TLS server certificates had been issued from Apple IST CAs 5, 6, or 7, and that the oversight was not detected until DigiCert notified Apple. Apple worked with its WebTrust assessors to amend the WTBR audit scope to include Apple IST CAs 5, 6, and 7. In remediation steps discussed in the thread, the certificates were to be revoked and added to OneCRL; DigiCert revoked the three CA certificates, and they were later added to OneCRL. The bug is marked RESOLVED with resolution FIXED.

1. 2019-07-25 DigiCert notified Apple that Apple IST CAs 5, 6, and 7 needed to be included in an amended WTBR report for the 16-April-2018 to 15-April-2019 audit period.
2. 2019-08-06 Apple met with its WebTrust assessors to finalize the plan to amend the WTBR report for the 16-April-2018 to 15-April-2019 audit period.
3. 2019-10-01 DigiCert revoked the three Apple IST CA certificates (IST CA 5, IST CA 6, IST CA 7).
4. 2019-10-18 The three Apple IST CA certificates were added to OneCRL.

1. 2019-08-20 Apple representative — Apple submitted an incident report describing how it became aware of the missing WTBR scope, stating no TLS server certificates were issued, and outlining remediation steps including amending the WTBR audit scope.
2. 2019-09-09 Community commenter — Ryan Sleevi stated the certificates need to be revoked and that there is no reasonable path to correct years of missing audits retroactively.
3. 2019-09-10 Fastly representative — Wayne Thayer stated the three Apple subCAs would be added to OneCRL to remediate the incident.
4. 2019-10-01 Apple representative — Apple reported that DigiCert revoked Apple IST CA 5, 6, and 7 certificates.
5. 2019-10-18 Fastly representative — Wayne Thayer stated the CAs were now in OneCRL.