Camerfirma disclosure and remediation for Govern d'Andorra intermediate CA audit issues

Camerfirma opened this bug to disclose issues found during the annual audit of the Government of Andorra intermediate CA, identified as "Entitat de Certificació de l'Administració Pública Andorrana." The company said it first learned of the problem from a negative audit report received on 2019-07-29, after an audit performed on 2019-07-17. Camerfirma reported that it stopped issuing certificates through the intermediate on 2019-07-31, later generated a new subordinate CA on 2019-10-17, and ultimately revoked the old intermediate on 2019-12-03. Mozilla reviewers asked for clarification about the intermediate, the audit scope, the certificate list, and the revocation plan, and Camerfirma later described process changes including a revised addendum, additional staffing, scope reviews, and a documented revocation/substitution process. The bug was resolved as FIXED.

1. 2019-07-17 Audit of the Government of Andorra intermediate CA was performed.
2. 2019-07-29 Camerfirma received a negative audit report with relevant deficiencies.
3. 2019-07-31 Issuance through the Government of Andorra intermediate CA was stopped.
4. 2019-10-17 A new subordinate CA was generated based on the PIT audit report.
5. 2019-12-03 The intermediate certificate for "Entitat de Certificació de l'Administració Pública Andorrana" was revoked.

1. 2019-08-21 AC Camerfirma, S.A. — Camerfirma reported the audit findings, said it stopped issuance on 2019-07-31, and outlined a plan to replace and later revoke the intermediate.
2. 2019-08-21 Community commenter — Ryan Sleevi asked for the complete certificate data and clarification of which intermediate was involved.
3. 2019-08-23 AC Camerfirma, S.A. — Camerfirma identified the intermediate as CN=Entitat de Certificació de l'Administració Pública Andorrana and said it had been disclosed in CCADB.
4. 2019-09-17 AC Camerfirma, S.A. — Camerfirma said the subCA had never issued TLS certificates, was blocked from issuing since 2019-07-31, and that it was reviewing other cases.
5. 2019-09-19 Mozilla representative — Mozilla marked the certificate "Ready to Add" to OneCRL for the next update batch.
6. 2019-11-09 AC Camerfirma, S.A. — Camerfirma said it had generated the new subCA on 2019-10-17 and expected revocation of the old one by 2019-11-20.
7. 2019-11-19 AC Camerfirma, S.A. — Camerfirma moved the revocation date to 2019-11-30.
8. 2019-11-29 AC Camerfirma, S.A. — Camerfirma said the intermediate would instead be revoked on 2019-12-04 and that this date was final.
9. 2019-12-03 AC Camerfirma, S.A. — Camerfirma reported that the intermediate certificate had been revoked that day.
10. 2020-07-24 AC Camerfirma, S.A. — Camerfirma posted a detailed revocation and massive substitution process for future subordinate CA problems.
11. 2020-08-28 AC Camerfirma, S.A. — Camerfirma said it would change the addendum language from "may revoke" to "will revoke".
12. 2020-09-07 AC Camerfirma, S.A. — Camerfirma said it had updated the addendum and passed it to its intermediate CAs.