Firmaprofesional: 2019 Audit Report Findings

This case tracks closure of findings from Firmaprofesional’s 2019 audit report. The reporter opened the bug while re-examining audit statements (including findings noted by AENOR) during the CP/CPS review for Firmaprofesional’s new root in Bug 1102143, and stated the purpose was to close all findings and provide incident reports for them. The thread describes three audit findings: (1) missing records for some revocation requests, preventing evidence that certificate status changes within 24 hours, and no observed non-authorized revocations during the audit period; (2) audit log permissions where the auditor role lacked permissions to review logs; and (3) SSL certificate entropy for “AC Firmaprofesional - INFRASTRUCTURE” being 63 bits instead of the 64 bits required. The CA stated it updated CCADB to address an ALV intermediate validation error and fixed a misspelling in URLs for standard and BR audits, and it referenced an incident/plan for the entropy issue in Bug 1538638 with biweekly updates until affected certificates were revoked. The CA then created an incident report for Finding #1 in Bug 1610448, and referenced related tickets for Findings #1 and #2 and noted Finding #3 was closed in Bug 1538638. A Mozilla participant later stated that the three corresponding finding bugs (1610448, 1612929, and 1538638) had been closed and suggested this bug could be closed as well; the bug is marked RESOLVED with resolution FIXED.

1. 2019-12-30 Bug 1606380 was opened to track closure of Firmaprofesional’s 2019 audit report findings.
2. 2020-01-13 Firmaprofesional reported work toward incident reports for Findings #1 and #2 and referenced prior handling of the entropy issue in Bug 1538638.
3. 2020-01-21 An incident report for Finding #1 was created in Bug 1610448.
4. 2020-05-22 Mozilla noted that the three finding-related bugs were closed and indicated this bug could be closed as well.

1. 2019-12-30 Community commenter — Opened the bug to track closure of all 2019 audit findings and provide incident reports, listing Findings #1–#3 and referencing related information (including Bug 1538638 for the entropy issue).
2. 2020-01-06 Isigma representative — Said they would begin creating incident reports and solutions after being on vacation.
3. 2020-01-13 Isigma representative — Reported updating CCADB to solve the ALV intermediate validation error, fixed a misspelling in audit URLs, and said they were now working on incident reports for Findings #1 and #2 while referencing a plan for the entropy issue in Bug 1538638.
4. 2020-01-13 Fastly representative — Acknowledged the update and stated they had reviewed and resolved Bug 1538638.
5. 2020-01-21 Isigma representative — Created/linked an incident report for Finding #1 (6.2) in Bug 1610448.
6. 2020-02-06 Isigma representative — Listed related tickets for Findings #1 and #2 and noted Finding #3 was closed in Bug 1538638.
7. 2020-05-22 Mozilla representative — Noted that all three corresponding finding bugs were closed (1610448, 1612929, 1538638) and suggested this bug could be closed.