Sectigo audit report delay and follow-up on updated WebTrust letters

This case concerned a potential delay in Sectigo’s WebTrust audit report submission to Mozilla via the CCADB. Sectigo said its WebTrust auditors informed it on 2020-06-25 that the report might be delayed, and Sectigo opened the bug to document the issue and keep Mozilla updated. Sectigo reported that its audit work was affected by work and travel restrictions, then later said the final reports had been received and would be uploaded to CCADB once signed versions were processed. The thread later expanded into discussion of audit scope, population listings, and the need for updated audit letters and seal URLs before CCADB could be updated. Mozilla ultimately updated the CCADB on 2020-10-23, and Sectigo said on 2020-10-26 that there was nothing further to discuss.

1. 2020-06-25 Sectigo’s WebTrust auditors warned of a possible delay to the audit report due to Mozilla.
2. 2020-07-01 Sectigo said it had received the final auditor reports and would update CCADB after processing signed versions.
3. 2020-10-05 Sectigo said updated audit letters had been received from EY and attached to the related audit case.
4. 2020-10-23 Mozilla updated the CCADB after receiving the needed audit materials.

1. 2020-06-25 Sectigo — Sectigo said its auditors had warned of a possible delay, and it filed the incident report while continuing normal CA operations.
2. 2020-06-29 Sectigo — Sectigo said the report was not likely to be ready that day and that it was still targeting delivery by 2020-07-06.
3. 2020-07-01 Sectigo — Sectigo said it had received the final reports from its auditors and would update CCADB after processing signed versions.
4. 2020-07-03 Sectigo — Sectigo said the reports had been added in Bug 1472993.
5. 2020-09-22 Sectigo — Sectigo explained that the delay involved audit scope issues and partial population listings, and said the auditors had halted seal issuance for some reports.
6. 2020-10-05 Sectigo — Sectigo said updated audit letters had been received from EY and that an explanatory letter was attached.
7. 2020-10-23 Mozilla representative — Mozilla said it had updated the CCADB and would close the bug unless more issues remained.
8. 2020-10-26 Sectigo — Sectigo said there was nothing further to discuss on the bug.