QuoVadis: Unconstrained CAs missing audits

The case addresses the issue of QuoVadis having unconstrained Certificate Authorities (CAs) that were missing necessary audits. Following a notification from the Chrome Root Authority program, QuoVadis identified 18 Intermediate Certificate Authorities (ICAs) that were not capable of issuing TLS certificates but had not been properly disclosed in their audit reports. The situation led to a series of revocations and updates to their audit processes to ensure compliance with Mozilla's requirements. QuoVadis has since revoked several CAs and updated their audit reports to include the previously omitted ICAs.

1. 2019-09-10 Received notification from Chrome Root Authority regarding audit status.
2. 2019-09-13 Met with WebTrust auditors to finalize audit report amendments.
3. 2019-10-07 Updated audit reports were issued for QuoVadis.
4. 2020-06-25 Revoked QuoVadis Swiss Advanced CA G2 and completed key destruction.