Camerfirma: Incorrect disclosure of Intesa Sanpaolo sub-CA

Camerfirma disclosed an “Intesa Sanpaolo Organization Validation 2019 CA” sub-CA on CCADB with the same CP/CPS as the parent, but with its own audits. In the bug, Andrew Ayer reported that the audit statement referenced a different CP/CPS (“Certificate Practice Statement Intesa Sanpaolo Organization Validation CA”) than the one disclosed for the sub-CA. Ana Lopes confirmed that the CCADB information was incorrect and said the correct CPS to reference is the sub-CA’s own CPS (version 1.6). She stated that the issue was caused by a human error while updating CCADB data and that no certificates with the problem were issued because it was an administrative error that did not affect certificates. Camerfirma said it corrected the CCADB mistake immediately on October 22, 2020, and committed to reviewing CCADB-published information every time they change it to avoid similar errors. The bug was later marked RESOLVED with resolution FIXED, and Mozilla indicated it would be scheduled for closure unless further issues were raised.

1. 2020-10-21 Andrew Ayer opened Bug 1672562 reporting that CCADB disclosure for the Intesa Sanpaolo sub-CA referenced the wrong CP/CPS.
2. 2020-10-22 Camerfirma reviewed the CCADB information and corrected the CPS link/data for the Intesa Sanpaolo Organization Validation 2019 sub-CA.
3. 2021-01-15 Camerfirma stated it had no further information to provide and requested closure.
4. 2021-01-22 Mozilla indicated it would schedule the bug for closure on or about 22-Jan-2021.

1. 2020-10-22 Mm representative — Reported that the disclosed CP/CPS for the Intesa Sanpaolo sub-CA did not match the CP/CPS referenced in the audit statement.
2. 2020-10-22 AC Camerfirma, S.A. — Acknowledged the CCADB disclosure mistake, provided the correct CPS link (version 1.6), and stated the issue was an administrative error with no affected certificate issuance.
3. 2021-01-04 AC Camerfirma, S.A. — Asked whether the bug could be closed or if more information was needed.
4. 2021-01-15 AC Camerfirma, S.A. — Said there was no more information to provide and asked Mozilla to proceed with closure if needed.
5. 2021-01-15 Mozilla representative — Said Mozilla would schedule the bug to close on or about 22-Jan-2021 unless other issues remained.
6. 2021-01-20 AC Camerfirma, S.A. — Confirmed there were no more updates to add.