← Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) cases
Bugzilla #1596949
Policy Compliance
FNMT: CP/CPS lack CAA processing details
RESOLVED
FIXED
Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT)
AI Summary
The Government of Spain's CA, FNMT, was found to have deficiencies in its Certificate Policy (CP) and Certification Practice Statement (CPS) regarding CAA record processing. Specifically, the documents did not specify the Issuer Domain Names recognized in CAA 'issue' records, which is a requirement under BR 2.2. Following an internal audit, FNMT acknowledged this oversight and committed to updating their CPS to include the necessary details. The issue was resolved with the publication of the updated CPS documents.
Chronology
- Initial report of missing CAA processing details in CP/CPS.
- FNMT provided links to the updated CPS documents addressing the issue.
- Bug resolved after FNMT's incident report and updates.
Participants
Andrew Ayer
Alain
Ryan Sleevi
Wayne Thayer
External References
Similar Local Cases
PKIoverheid: KPN CPS lacks CPR problem reporting instructions
Amazon Trust Services: CP/CPS does not specify key compromise methods
KIR S.A.: CP/CPS contains noncompliant DV method, does not specify CAA domains
Sectigo: Missing Changelog in CPS
Amazon Trust Services: Forbidden Domain Validation Method 3.2.2.4.6
SECOM: CP/CPS does not clearly specify domain validation methods
Camerfirma: CP/CPS of Intesa Sanpaolo Sub-CA is Non-Compliant
GoDaddy: inconsistent disclosure of externally-operated intermediate