PKIoverheid: Missing Intermediate CA from audit statement

PKIoverheid (Logius) filed this bug after CCADB notified it that the fingerprint of the issuing CA “UZI-register Medewerker niet op naam CA G21” was missing from an audit statement supplied by CIBG for the 2017/2018 yearly audit. Logius stated that the CA in question had been “skipped” in the yearly audit in 2017/2018 and 2018/2019, and that this was due to a misinterpretation of Mozilla requirements by both Logius and CIBG. Logius explained that issuance by this CA was halted in June 2017 due to a new ETSI certificate profile requirement that CIBG’s systems could not comply with at the time, and that the CA was intended to be resumed later under a new G3 TSP CA. In response to the discovery, Logius created this bug and later reported remediation steps, including that all certificates were revoked and that the CA would be revoked. The thread states that the CA was revoked and placed on a CRL, and a Fastly participant confirmed the CA was revoked and that remediation was complete. The bug was resolved as FIXED.

1. 2017-06-01 Issuance of certificates by the CA “UZI-register Medewerker niet op naam CA G21” was halted due to an ETSI certificate profile requirement that systems could not comply with at the time.
2. 2019-11-25 CCADB notified Logius that the fingerprint of the issuing CA was missing from the audit statement for the 2017/2018 yearly audit.
3. 2019-11-28 CIBG provided a formal response explaining why the CA was halted and how audits were interpreted.
4. 2020-01-15 Logius created the Bugzilla case after internal discussions with CIBG.
5. 2020-02-17 Logius reported that all certificates had been revoked and that the CA would be revoked later that week.
6. 2020-02-20 Logius reported that the CA was revoked and placed on a CRL.

1. 2020-01-16 Logius representative — Logius described how it became aware of the missing CA fingerprint in the audit statement and outlined the background and remediation timeline.
2. 2020-01-17 Community commenter — Ryan asked follow-up questions about the reporting timeline and prevention steps, referencing Mozilla incident-report expectations.
3. 2020-02-12 Logius representative — Logius responded with planned process changes for faster disclosure and reporting, and discussed operational context for PKIoverheid TSPs.
4. 2020-02-17 Logius representative — Logius stated that all certificates had been revoked and that the CA would be revoked later that week.
5. 2020-02-20 Logius representative — Logius reported that the CA “UZI-register Medewerker niet op naam CA G21” was revoked and placed on CRL at http://www.csp.uzi-register.nl/cdp/zorg_csp_ca_g21.crl.
6. 2020-02-22 Fastly representative — Fastly confirmed the CA was revoked and that remediation was complete.