LuxTrust: Outdated audit statement for intermediate certificate

LuxTrust reported that an intermediate certificate record in the CCADB had an outdated audit statement. The initial request asked LuxTrust to update the CCADB record with the current audit statement information and to provide an Incident Report for the overdue audit statement. LuxTrust said the issue was an omission in the attestation letter, and that it requested an updated attestation letter from the auditor on September 4, then updated the CCADB record after receiving it. LuxTrust also stated the incident was due to a wording oversight rather than an operational or security issue, and that it did not stop issuing certificates. In the thread, Mozilla noted that an incident report was not present as requested, and later checked whether LuxTrust had responded. Mozilla ultimately indicated the parent CA (LuxTrust Global Root 2) had been removed and closed the bug.

1. 2019-09-03 LuxTrust opened a CA Program bug requesting CCADB updates for an intermediate certificate with an outdated audit statement.
2. 2019-09-05 LuxTrust reported requesting an updated attestation letter from the auditor and planned to update CCADB upon receipt.
3. 2019-09-20 LuxTrust provided a link to the updated attestation letter and confirmed the CCADB record was updated and ALV passed.
4. 2020-03-13 LuxTrust submitted an incident-report response describing the cause and remediation steps.
5. 2020-07-29 Mozilla closed the bug after noting the parent CA had been removed.

1. 2019-09-03 Mozilla representative — Requested LuxTrust update the CCADB record for an intermediate certificate with an outdated audit statement and provide an Incident Report, citing the CCADB intermediate certificate page and Mozilla’s incident-report guidance URL.
2. 2019-09-05 Luxtrust representative — Explained the outdated attestation was an omission in the attestation letter, said LuxTrust requested an updated attestation letter from the auditor on September 4, and would update CCADB upon receipt; stated a 4-eye verification process was put in place.
3. 2019-09-20 Luxtrust representative — Provided a URL to the updated attestation letter PDF.
4. 2019-09-20 Mozilla representative — Confirmed the audit attestation letter was added to CCADB and ALV passed, but asked to resolve additional intermediate-certificate audit-statement inconsistencies and to provide an Incident Report for those missing audit attestations.
5. 2020-01-21 Community commenter — Stated there did not appear to be an incident report on the issue as requested.
6. 2020-03-13 Luxtrust representative — Submitted a structured incident-report response describing how LuxTrust became aware, actions taken, that issuing was not stopped, the cause as a mistaken “Audits Same as Parent” tick and misunderstanding of requirements, and remediation steps including clarifying requirements and strengthening supervision of CCADB publication.
7. 2020-03-13 Community commenter — Criticized the incident report for not addressing the significance of the CCADB publication gap and questioned whether calendar reminders would ensure continuity.
8. 2020-05-22 Mozilla representative — Checked in, stating it appeared Mozilla was still awaiting a response from LuxTrust.
9. 2020-06-20 Mozilla representative — Noted the parent CA (LuxTrust Global Root 2) had been removed and indicated inclination to close the bug.
10. 2020-07-29 Mozilla representative — Closed the bug.