DigiCert: Verizon CPS lacks CPR problem reporting instructions

This case concerns a Baseline Requirements compliance issue in Verizon’s Cybertrust CPS as published under DigiCert’s root program. The reporter noted that, per BR 4.9.3, the CPS should include certificate problem reporting instructions in section 1.5.2, but the published CPS did not contain those instructions there. DigiCert’s assigned representative stated that the CPS instead included a certificate problem report email address in section 4.11, and said they would investigate why the required section was not used. Verizon reported that it was alerted on November 15, 2019 that section 1.5.2 lacked the required CA support contact information, and that the issue was resolved by publishing a revised CPS on November 19, 2019. The thread also includes discussion that DigiCert reviewed other sub CAs, asked two others to update their CPS for clarity, and sent notices to other CAs found in CCADB with similar issues. A later comment stated that remediation was complete and that all questions had been answered. The bug is marked RESOLVED with resolution FIXED.

1. 2019-11-15 Verizon was alerted that its Cybertrust CPS section 1.5.2 lacked required certificate problem reporting contact information.
2. 2019-11-19 Verizon published a revised Cybertrust CPS (v5.15) addressing the missing information in section 1.5.2.

1. 2019-11-15 Mm representative — Reported that the CPS for a specified Cybertrust CPS PDF did not include certificate problem reporting instructions in section 1.5.2 as required by BR 4.9.3.
2. 2019-11-15 DigiCert — Said the CPS contains the certificate problem report email in section 4.11 and would investigate why the required section was not used.
3. 2019-11-19 Intl representative — Stated Verizon resolved the issue by publishing a revised CPS on November 19, 2019.
4. 2019-11-19 Mm representative — Asked about the process for keeping the CPS up to date with Baseline Requirements and what changes would prevent recurrence.
5. 2019-11-26 DigiCert — Described reviewing other sub CAs, asking two to update their CPS for clarity, scanning CCADB for similar issues, and sending notices to fix them.
6. 2019-12-03 Community commenter — Questioned whether additional issues should be created and whether the problem was limited to this bug or broader.
7. 2019-12-03 DigiCert — Clarified that the notices were for independent CAs not controlled by DigiCert and that no other DigiCert sub CAs lacked contact information.
8. 2019-12-03 Fastly representative — Commented that all questions were answered and remediation was complete.