Google Trust Services: Out-of-date CPS disclosure
The case concerns Google Trust Services (GTS) having an out-of-date CPS disclosure in the Common CA Database (CCADB). The CCADB record indicated the root operates under a CPS versioned v2.22 dated 2020-08-21, with the CPS URL https://pki.goog/repo/cps/2.22/GTS-CPS.pdf. However, https://pki.goog publishes a newer CPS versioned v3.0 dated 2021-03-19 at https://pki.goog/repo/cps/3.0/GTS-CPS.pdf, which was described as a violation of CCADB Policy Section 5 requiring CPS URLs to be updated as new information becomes available. GTS acknowledged the report, and Mozilla staff noted that an incident report was being prepared with full details. Mozilla later stated that CAs cannot update their CPs and CPSes in CCADB without additional intervention from the root store member of CCADB. The Mozilla staff member then indicated they had updated/corrected the CCADB record and marked the bug as invalid.
- A CCADB compliance issue was reported regarding an out-of-date CPS URL for a GTS root.
- GTS acknowledged the report and Mozilla indicated an incident report was being prepared.
- Mozilla corrected the CCADB record and marked the bug invalid.
- Mm representative — Reported that CCADB listed GTS CPS v2.22 (2020-08-21) but https://pki.goog publishes a newer CPS v3.0 (2021-03-19), citing a CCADB Policy Section 5 violation.
- Google representative — Acknowledged the report and said other roots were updated in CCADB on March 25, with an incident report being prepared for the GS R2 update.
- Mozilla representative — Stated that CAs cannot update their CPs and CPSes in CCADB without additional intervention from the root store member.
- Mozilla representative — Said this may have been an oversight, that the CCADB record was updated/corrected, and marked the bug as invalid.