Microsoft PKI Services intermediate certificate audit document repository and draft audit feedback
This bug was opened by Microsoft to store documents related to publicly disclosed and audited intermediate certificates chaining to Microsoft PKI Services root certificates. The thread has primarily been used to upload draft and final audit letters, management assertions, and related auditor materials for multiple Microsoft PKI, TRP, ACS, WTCA, WTBR, WTNS, and WTCS programs across several years. In July 2025, Microsoft also uploaded a 2025 CCADB Self Assessment Framework file. New activity in June 2026 added a draft 2026 Microsoft PKI WTCA independent accountant's opinion report and management assertion. A third-party commenter then raised concerns that the draft audit did not appear to list several Microsoft incident bugs and quoted CCADB Policy section 5.2 about audit statement content. Microsoft responded that it would review the observations with its auditor during report finalization and provide an update after that review. The bug remains RESOLVED, and the thread continues to function as a document and feedback repository rather than an incident report about certificate issuance or revocation itself.
- Microsoft opened the bug to store documents for publicly disclosed and audited intermediate certificates chaining to Microsoft PKI Services roots.
- Microsoft uploaded final audit letters and related auditor materials.
- Microsoft uploaded a final 2025 CCADB Self Assessment Framework file.
- Microsoft uploaded a draft 2026 Microsoft PKI WTCA audit report and management assertion.
- Microsoft said it would review third-party feedback on the draft audit with its auditor during report finalization.
- Microsoft Corporation — Microsoft said the bug's purpose was to store documents related to publicly disclosed and audited intermediate certificates chaining to Microsoft PKI Services root certificates.
- Mozilla representative — Mozilla closed the bug but said it could still be used to upload documents.
- Microsoft Corporation — Microsoft uploaded final audit letters and said audit letters were submitted for ALV testing.
- Disabled representative — Additional 2022 auditor opinion attachments were uploaded to the bug.
- Microsoft Corporation — Microsoft uploaded several draft June 2023 accountant opinion and management assertion documents.
- Microsoft Corporation — Microsoft uploaded a draft May 2024 internal-only WTCA report.
- Microsoft Corporation — Microsoft uploaded multiple draft 2024 WebTrust reports for TLS, TRP, code signing, and network security programs.
- Microsoft Corporation — Microsoft uploaded multiple draft June 2025 accountant opinion and management assertion documents.
- Microsoft Corporation — Microsoft uploaded additional draft June 2025 PDF audit documents.
- Microsoft Corporation — More draft June 2025 audit report attachments were added for several Microsoft PKI and TRP programs.
- Microsoft Corporation — Further draft and versioned June 2025 audit report attachments were uploaded.
- Microsoft Corporation — Version 6 TRP WTCA and WTNS June 2025 draft audit documents were uploaded.
- Microsoft Corporation — Microsoft uploaded final 2025 CCADB Self Assessment Framework attachments.
- Microsoft Corporation — Microsoft uploaded a draft 2026 Microsoft PKI WTCA independent accountant's opinion report and management assertion.
- Community commenter — A third-party commenter said the draft audit appeared to omit several incident bugs and cited CCADB Policy section 5.2 on audit statement content.
- Microsoft Corporation — Microsoft said it would review the feedback with its auditor as part of finalizing the report and would provide an update afterward.