Asseco DS / Certum: CPS does not refer to BR domain validation methods
This case concerns Certum’s CPS (version 7.0) not clearly referencing the specific BR subsections for domain validation methods. The reporter stated that the CPS does not refer to the subsections of BR 3.2.2.4 and that this is contrary to MRSP 2.2.3, noting ambiguity around whether “Agreed-Upon Change to Website” in CPS 3.2.2.1 relates to BR 3.2.2.4.6 or 3.2.2.4.18. Certum responded that it would analyze the issue and later stated that it updated the CPS by adding links to the relevant BR points. Certum also explained that it had introduced changes in chapter 3.2.2.1 in earlier CPS versions (6.8 and 6.9) describing domain verification methods, but had not added information mapping those methods to the BR subchapters. The updated CPS was published as version 7.1 on 2021-06-30, and the thread later indicated no further updates and that the bug could be closed. The bug is marked RESOLVED with resolution FIXED.
- Certum’s CPS version 7.0 was published and the bug was created in response to the reported CPS/BR mapping issue.
- Certum published CPS version 7.1 with added links to the relevant BR points.
- The bug was anticipated to be closed (per Mozilla comment).
- Fozzie representative — Reported that Certum’s CPS 7.0 does not refer to BR 3.2.2.4 subsections and questioned whether the “Agreed-Upon Change to Website” method mapping is ambiguous between BR 3.2.2.4.6 and 3.2.2.4.18.
- Assecods representative — Acknowledged the report and said Certum would analyze the CPS point again and respond.
- Assecods representative — Provided a response describing Certum’s analysis and stated it would update the CPS to reference the relevant BR subchapters, with a planned publication date of 2021-06-30.
- Fozzie representative — Argued that stating the subsection name may meet MRSP requirements and asked whether other CPS parts might have similar ambiguity.
- Assecods representative — Stated Certum updated CPS by adding links to BR points and provided a URL to CPS 7.1.
- Assecods representative — Indicated there were no updates and asked if there were any further questions.
- Assecods representative — Said there were no updates.
- Assecods representative — Asked whether the bug could be closed if there were no additional questions.
- Mozilla representative — Said Mozilla would anticipate closing the bug on 30-July-2021 unless otherwise heard.