Camerfirma: SMIME Improvement Plan
This case documents Camerfirma’s SMIME Improvement Plan and related communications following discussion of issues. Camerfirma states that its S/MIME certificate issuance and management processes are regulated under eIDAs, audited yearly, and supervised by the Spanish National Supervisor Body. Camerfirma attached a plan describing actions to further improve SMIME certificate management practices, including process automation for outlier activity patterns, standardized certificate attribute values to avoid human errors, and post-issuance control items. The plan also includes contractual and compliance-related work, such as insourcing operational activities of intermediate CAs and performing audits of the totality (100%) of certificates issued, along with audit of the email validation process. In later updates, Camerfirma reported progress on insourcing intermediate CA management, including revoking the intermediate CA DigitalSign Primary CA on September 28 due to timing related to inclusion of a new subCA in the AATL. The bug was closed as RESOLVED with resolution FIXED by Ben Wilson on January 18, 2023.
- Camerfirma submitted documentation of its SMIME Improvement Plan and related items for Mozilla review.
- Camerfirma provided details of actions to improve SMIME certificate management practices.
- Camerfirma posted SMIME Improvement Plan progress updates across multiple workstreams.
- Camerfirma submitted additional SMIME Improvement Plan progress update materials.
- Camerfirma submitted another SMIME Improvement Plan progress update.
- Camerfirma reported revocation of the intermediate CA DigitalSign Primary CA as part of insourcing efforts.
- Mozilla closed the bug as FIXED.
- Mozilla representative — Ben Wilson stated the entry is for Camerfirma’s documentation of its SMIME Improvement Plan and related communications following discussion of issues.
- AC Camerfirma, S.A. — Ana Lopes said the attached document sets out actions to improve SMIME certificate management practices and described the regulatory/audit/supervision context.
- AC Camerfirma, S.A. — Ana Lopes posted progress updates for the SMIME Improvement Plan, including automation for revocation outlier detection, standardized certificate attribute values, and compliance/audit activities.
- AC Camerfirma, S.A. — Eusebio Herrera attached a SMIME Improvement Plan progress updates document.
- AC Camerfirma, S.A. — Eusebio Herrera attached another SMIME Improvement Plan progress update document.
- AC Camerfirma, S.A. — Eusebio Herrera reported that Camerfirma revoked the intermediate CA DigitalSign Primary CA on September 28, citing delay due to waiting for inclusion of a new subCA in the AATL.
- Mozilla representative — Ben Wilson said he would close the bug on January 18, 2023 unless issues or questions remained.