Firmaprofesional: 2020 Audit Report Finding 4 out of 4

This case involves Firmaprofesional's disclosure of a compliance issue identified during their 2020 audit. The CA reported that a valid certificate was issued before the effective date of the EVCG version 1.7.0, which included the subject:organizationIdentifier field. The CA took corrective actions, including revoking the problematic certificate and implementing changes to their issuance process to prevent future occurrences. The incident was documented, and a timeline of actions was provided, detailing the steps taken from the discovery of the issue to the resolution. The case has been resolved with the CA committing to improved compliance measures.

1. 2020-04-14 Non-conformity registered in JIRA and action plan established.
2. 2020-05-07 Immediate revocation of the problematic certificate communicated and executed.

1. 2020-07-01 Autoridad de Certificacion Firmaprofesional — Reported findings from the annual audit, including details of the compliance issue.
2. 2020-07-26 Community commenter — Requested deeper analysis of root causes and timely revocation concerns.
3. 2020-09-02 Mozilla representative — Reviewed the incident report and raised questions about the incident response.
4. 2021-01-25 Autoridad de Certificacion Firmaprofesional — Requested closure of the bug.