QuoVadis unconstrained CAs missing BR audit disclosure and subsequent revocations

This case concerns QuoVadis’ disclosure and audit coverage for 18 intermediate CAs that were technically capable of TLS issuance but were not actually used to issue TLS certificates. The issue was triggered when QuoVadis received an email from the Chrome Root Authority program on 2019-09-10 asking for confirmation of Baseline Requirements audit disclosures. QuoVadis investigated, met with auditors, and later had EY reissue the 2018 WebTrust for Baseline Requirements report to name the 18 CAs; it also reissued the 2018 WebTrust for EV report to add one omitted EV ICA. QuoVadis then revoked the affected CAs in stages, requested OneCRL inclusion, and retained EY for an attestation report covering 2014–2017 for the remaining unrevoked CAs. The final two actions were delayed by COVID-19 restrictions, but QuoVadis later completed revocation of QuoVadis Swiss Advanced CA G2 and key destruction for QuoVadis Issuing CA G4. The bug was resolved after the audit report and key-destruction confirmation were provided.

1. 2019-09-10 QuoVadis learned of missing Baseline Requirements audit disclosure for 18 intermediate CAs.
2. 2019-10-07 EY reissued the 2018 WebTrust for Baseline Requirements and EV reports to correct the disclosures.
3. 2019-10-31 QuoVadis Personal Signing Service CA G1 was revoked.
4. 2020-01-31 Several additional QuoVadis issuing CAs were revoked, leaving two remaining CAs.
5. 2020-06-25 QuoVadis Swiss Advanced CA G2 was revoked and QuoVadis Issuing CA G4 underwent key destruction.
6. 2020-07-13 EY completed validation of the key destruction procedures for QuoVadis Issuing CA G4.

1. 2019-09-16 DigiCert — Stephen Davidson opened the case and explained that QuoVadis found 18 ICAs that were not disclosed in the BR report because they did not issue TLS certificates.
2. 2019-09-17 Mozilla representative — Kathleen Wilson asked Stephen to verify the spreadsheet of items to be added to OneCRL and noted the CCADB records were marked Ready to Add.
3. 2019-09-24 Community commenter — QuoVadis said it had reconciled all ICAs to the 2018 WebTrust reports and that EY would reissue the BR and EV reports.
4. 2019-10-07 Community commenter — QuoVadis reported that EY had reissued the 2018 BR report to name the 18 CAs and reissued the EV report to add the omitted EV ICA.
5. 2019-10-23 DigiCert — Stephen Davidson said six of the CAs had been revoked, OneCRL had been requested, and EY had been retained for an AT-C 105 attestation report for 2014–2017.
6. 2020-03-06 DigiCert — QuoVadis said it was still replacing end-entity certificates under the remaining two subCAs and described a plan for QuoVadis Issuing CA G4 involving TSA certificates, pre-generated CRLs, and key destruction.
7. 2020-04-17 DigiCert — QuoVadis said EY’s attestation report confirmed the listed ICAs were in scope for BR procedures and had not issued TLS-capable certificates from 2014 through 2017.
8. 2020-06-25 DigiCert — QuoVadis reported revocation of QuoVadis Swiss Advanced CA G2 and completion of a key destruction ceremony for QuoVadis Issuing CA G4.
9. 2020-07-14 DigiCert — QuoVadis said EY had validated the key destruction procedures for QuoVadis Issuing CA G4 and provided the report to Mozilla representatives.
10. 2020-08-16 Mozilla representative — Mozilla noted that the E&Y audit statement described physical observation of the CA destruction process.