Firmaprofesional / SIGNE: No BR audit for intermediate CA technically capable of issuing TLS certificates

The case concerns a Firmaprofesional subordinate CA (SIGNE Autoridad de Certificacion) that had no CA/Browser Forum Baseline Requirements (BR) audit, even though it was technically capable of issuing TLS certificates. The issue was raised because this was described as a violation of BR section 8 and Mozilla’s Root Store Policy. Firmaprofesional stated that SSL/TLS certificates had never been issued by this subordinate CA, and that it was identified during investigation after a Bugzilla bug was opened on 2019-10-03. Firmaprofesional initiated steps to revoke the affected certificate and to include it in OneCRL. The revocation was scheduled for 2019-10-22, and Firmaprofesional later confirmed that the certificate was revoked on 2019-10-22 as planned. The reporter also confirmed the certificate would be added to OneCRL in the next batch of updates. The bug is marked RESOLVED with resolution FIXED.

1. 2019-10-03 A Bugzilla bug was opened regarding the SIGNE subordinate CA lacking a required BR audit despite being technically capable of issuing TLS certificates.
2. 2019-10-04 Firmaprofesional completed its investigation and scheduled revocation for the affected subordinate CA certificate.
3. 2019-10-22 The affected subordinate CA certificate was revoked.

1. 2019-10-03 Community commenter — Reported that there is no BR audit for Firmaprofesional’s SIGNE subordinate CA that is technically capable of issuing TLS certificates, and referenced BR section 8 and Mozilla’s Root Store Policy.
2. 2019-10-04 Autoridad de Certificacion Firmaprofesional — Described Firmaprofesional’s investigation and stated SSL/TLS certificates had never been issued, concluding there is no BR audit for the SIGNE subCA, and that revocation and OneCRL inclusion would be initiated.
3. 2019-10-10 Autoridad de Certificacion Firmaprofesional — Stated the certificate revocation was scheduled for 2019-10-22.
4. 2019-10-28 Autoridad de Certificacion Firmaprofesional — Confirmed the certificate was revoked on 2019-10-22 as planned.
5. 2019-10-28 Community commenter — Confirmed the certificate has been revoked and will be added to OneCRL during the next batch of updates.