Sectigo: Missing SHA-256 thumbprint in audit attestation for D-TRUST CA 2-1 2015 (ALV failure)

This case concerns an ALV (Audit Letter Validation) failure in CCADB for the intermediate CA certificate D-TRUST CA 2-1 2015. Sectigo said it became aware of the issue after an email from Kathleen alerted CAs to a CCADB summary item indicating 9 intermediate CA certificates with failed ALV results, and this bug addressed 1 of those 9 certificates. Sectigo reported that the audit report for D-TRUST CA 2-1 2015 did not include the SHA-256 hash (and was also the German-language version rather than the English version required by Mozilla’s Root Store Policy section 3.1.4). Sectigo stated it evaluated options to fix the failed ALV results, emailed D-Trust about the issue, and received a new Audit Attestation in mid-December 2019, which Sectigo then posted to CCADB on 2 January 2020. Mozilla staff later stated that CCADB showed the certificate passed the ALV check in January based on an updated audit report from TuvIT dated 2019-12-03, and that the incident report adequately explained remediation steps, so the bug was closed. The bug’s resolution is FIXED and the current status is RESOLVED.

1. 2019-10-08 Mozilla’s CCADB ALV summary indicated intermediate CA certificates with failed ALV results, prompting follow-up on D-TRUST CA 2-1 2015.
2. 2019-11-19 D-Trust indicated a new Audit Attestation would be available in mid-December.
3. 2020-01-02 Sectigo posted the updated Audit Attestation to CCADB.

1. 2019-11-20 Sectigo — Sectigo reported that D-TRUST CA 2-1 2015 was missing the SHA-256 thumbprint in the audit report and said a new Audit Attestation including it was being prepared.
2. 2020-06-02 Sectigo — Sectigo explained how it became aware (Kathleen’s email), described the timeline and remediation steps (including receiving and posting an updated Audit Attestation), and stated it would more diligently check audit reports for Mozilla policy compliance.
3. 2020-07-08 Mozilla representative — Mozilla stated CCADB showed the certificate passed ALV in January based on an updated audit report dated 2019-12-03 and closed the bug.