Microsoft PKI Services CA documents repository with audit-report follow-up
This bug was opened by Microsoft to store documents related to publicly disclosed and audited intermediate certificates chaining to Microsoft PKI Services root certificates. Over time, Microsoft used the thread to upload preliminary, draft, and final audit letters, management assertions, auditor qualification material, and CCADB self-assessment files. In June 2026, Microsoft uploaded a draft 2026 Microsoft PKI WTCA independent accountant's opinion report and management assertion. A third-party commenter then said the draft audit appeared to omit several Microsoft incident bugs and cited CCADB Policy section 5.2 about audit statement content. Microsoft first said it would review the observations with its auditor during report finalization. Since the previous summary, Microsoft added that it worked with its auditor to address the reporting gaps raised for the three issues identified in the audit report, and that the current audit report was updated to include additional information needed to satisfy the applicable reporting expectations for those incidents. The bug remains RESOLVED with resolution WORKSFORME and continues to function as a document repository and audit-document discussion thread.
- Microsoft opened the bug to store documents for publicly disclosed and audited intermediate certificates chaining to Microsoft PKI Services roots.
- Microsoft uploaded final audit letters and related auditor materials.
- Microsoft uploaded a final 2025 CCADB Self Assessment Framework file.
- Microsoft uploaded a draft 2026 Microsoft PKI WTCA audit report and management assertion.
- Microsoft said it would review third-party feedback on the draft audit with its auditor during report finalization.
- Microsoft uploaded a 2026 CCADB Self Assessment Framework file.
- Microsoft said it worked with its auditor to address reporting gaps and updated the current audit report with additional incident information.
- Microsoft Corporation — Microsoft said the bug's purpose was to store documents related to publicly disclosed and audited intermediate certificates chaining to Microsoft PKI Services root certificates.
- Mozilla representative — Mozilla closed the bug but said it could still be used to upload documents.
- Microsoft Corporation — Microsoft uploaded final audit letters and said audit letters were submitted for ALV testing.
- Disabled representative — Additional 2022 auditor opinion attachments were uploaded to the bug.
- Microsoft Corporation — Microsoft uploaded several draft June 2023 accountant opinion and management assertion documents.
- Microsoft Corporation — Microsoft uploaded a draft May 2024 internal-only WTCA report.
- Microsoft Corporation — Microsoft uploaded multiple draft 2024 WebTrust reports for TLS, TRP, code signing, and network security programs.
- Microsoft Corporation — Microsoft uploaded multiple draft June 2025 accountant opinion and management assertion documents.
- Microsoft Corporation — Microsoft uploaded additional draft June 2025 PDF audit documents.
- Microsoft Corporation — More draft June 2025 audit report attachments were added for several Microsoft PKI and TRP programs.
- Microsoft Corporation — Further draft and versioned June 2025 audit report attachments were uploaded.
- Microsoft Corporation — Version 6 TRP WTCA and WTNS June 2025 draft audit documents were uploaded.
- Microsoft Corporation — Microsoft uploaded final 2025 CCADB Self Assessment Framework attachments.
- Microsoft Corporation — Microsoft uploaded a draft 2026 Microsoft PKI WTCA independent accountant's opinion report and management assertion.
- Community commenter — A third-party commenter said the draft audit appeared to omit several incident bugs and cited CCADB Policy section 5.2 on audit statement content.
- Microsoft Corporation — Microsoft said it would review the feedback with its auditor as part of finalizing the report and would provide an update afterward.
- Microsoft Corporation — Microsoft uploaded a 2026 CCADB Self Assessment Framework attachment.
- Microsoft Corporation — Microsoft said it worked with its auditor to address reporting gaps for the three issues identified in the audit report and updated the current audit report with additional information.