PKIoverheid (Logius): Missing intermediate CA certificates in WTBR management assertion audit statements (2017/2018)

This case is a self-disclosure by PKIoverheid (Logius) about missing intermediate CA certificates in its WTBR management assertion audit statements for 2017/2018. Logius said it became aware of the problem in mid-November 2019 while reviewing audit records in CCADB, where an ALV warning indicated that several fingerprints were missing for its Domain CAs (level 2 CAs). Logius stated that although WTBR audits had taken place for several domain CAs, they were not properly listed in the management assertion over the past years. In response, Logius worked with KPMG to issue revised management assertions and to obtain revised opinions covering the concerned period. The thread also notes that Logius submitted updated CCADB audit cases with the revised reports, and Fastly’s Wayne Thayer indicated additional CP/CPS information was required before processing could complete. Kathleen A. Wilson later stated she finished processing the audit cases and closed the bug. The bug is resolved as FIXED.

1. 2017-03-01 Logius issued its first management assertion listing SHA256 fingerprints as required by Mozilla.
2. 2019-11-25 Logius noticed ALV warnings in CCADB audit records indicating missing fingerprints for several Domain CAs.
3. 2019-12-13 KPMG produced WebTrust auditor reports for BR covering all domain CAs (as referenced in the thread attachments).
4. 2019-12-19 Logius created the bug and attached revised WTBR management assertions and related KPMG reports.
5. 2020-01-07 Logius submitted updated CCADB audit cases with the revised reports.
6. 2020-02-05 Mozilla processed the audit cases and closed the bug.

1. 2019-12-19 Logius representative — Created the bug and described that CCADB review in mid-November 2019 (ALV warning) showed missing fingerprints in WTBR management assertions for several Domain CAs, despite WTBR audits having occurred.
2. 2019-12-19 Logius representative — Attached revised WTBR management assertion documents for 2017 and 2018.
3. 2019-12-19 Fastly representative — Asked Jorik to submit a new CCADB audit case with the updated reports.
4. 2020-01-08 Logius representative — Confirmed that updated CCADB audit cases were submitted on January 7.
5. 2020-01-17 Fastly representative — Said CCADB cases #538 and #539 needed more information (CP/CPS information) and pointed to https://ccadb.org/cas/updates.
6. 2020-01-21 Logius representative — Reported that cases #538 and #539 were updated in CCADB.
7. 2020-01-21 Fastly representative — Confirmed the cases were awaiting verification.
8. 2020-02-05 Mozilla representative — Stated she finished processing the audit cases and would close this bug.