TrustCor: No mention of TLS-capable Intermediate CAs in WTBR audit reports

TrustCor reported that Mozilla alerted it to discrepancies between its WebTrust for CAs report and its SSL Baseline with Network Security report for two subordinate CAs. TrustCor stated that it had failed to disclose the subordinate CAs in both reports, which it recognized as a violation of BR Section 8.1, and said the omission was due to a misreading of requirements for CA certificates not intended for SSL certificate issuance (S/MIME in this case). TrustCor described actions including investigating the scope, communicating with its independent auditor, suspending its Enhanced Secure Email CA program temporarily, reconciling HSM activities with issuance logs, reorganizing CCADB data to remove mistaken certificates from the ALV report, and submitting new audit reports that mentioned the Email CAs in the SSL-BR report. TrustCor also stated that it requested addition of the Email CA certificates to OneCRL. In follow-up, TrustCor reported that the Basic Secure Email CA certificate was revoked (as of 2020-04-01 17:05:00 UTC) and that the Enhanced Secure Email CA certificate was formally revoked (as of 2019-12-05 17:10:18 UTC), and that new CRLs and OCSP responses were published. The thread indicates remediation was complete and the bug was resolved as FIXED.

1. 2019-10-08 Mozilla Dev Security Policy post alerted TrustCor to discrepancies between its basic audit report and SSL-BR audit report.
2. 2019-10-10 TrustCor formally suspended its Enhanced Secure Email CA program pending resolution.
3. 2019-11-15 TrustCor completed a self-audit and submitted new audit reports that mentioned the Email CAs in the SSL-BR report.
4. 2019-12-05 TrustCor formally revoked the Enhanced Secure Email CA certificate.
5. 2020-04-01 TrustCor revoked the Basic Secure Email CA certificate and published new CRLs and OCSP responses.

1. 2019-11-26 Trustcorsystems representative — Opened the case describing how TrustCor became aware of the reporting discrepancy, the cause (misreading requirements), and the remediation steps including new audit reports and OneCRL addition request.
2. 2019-11-26 Trustcorsystems representative — Provided crt.sh links for the two CA certificates and clarified that no SSL certificates were logged under them via CT logs.
3. 2019-11-26 Mozilla representative — Updated CCADB records to mark the corresponding intermediates as "Ready to Add" to OneCRL and shared the CCADB URL.
4. 2020-04-01 Trustcorsystems representative — Reported revocation of the Basic Secure Email CA (2020-04-01 17:05:00 UTC) and that the Enhanced Secure Email CA had been formally revoked on 2019-12-05 17:10:18 UTC, with new CRLs/OCSP published.
5. 2020-04-01 Community commenter — Noted that Bug 1599571 tracks delayed revocation and suggested the case be ready for closure if agreed.
6. 2020-04-06 Fastly representative — Confirmed it appeared all questions were answered and remediation was complete.