Apple: Intermediate CA certificates omitted from WTBR audit statement
Apple opened this incident report after receiving a notification from its root vendor (DigiCert) about intermediate certificate records in CCADB that had outdated audit statements. Apple reviewed its intermediate CA records and identified three EV Sub-CAs that were omitted from the recently issued “WebTrust for Certification Authorities – SSL Baseline with Network Security” (WTBR) audit statement, even though they were listed on the “WebTrust Principles and Criteria for Certification Authorities – Extended Validation SSL” (WTEV) and “WebTrust Principles and Criteria for Certification Authorities” (WTCA) audit statements. Apple verified with its external WebTrust auditors that the omission was an unintended error and that the completed audits correctly covered the omitted EV Sub-CAs. Apple received amended audit statements and distributed them to Mozilla and the root vendor, and it published an amended WTBR audit report. Apple also updated its quality review procedures, including clearer documentation and additional steps involving independently generated Sub-CA lists from root vendors. Apple reported that there were no outstanding tasks and asked to close the incident; Mozilla indicated it would close the bug on 1-Sep-2021.
- Apple received a DigiCert notification that CCADB contained intermediate certificate records with outdated WTBR audit statements.
- Apple received amended audit statements and distributed them to Mozilla and the root vendor.
- Apple published an amended WTBR audit report and attached/published the report to Bugzilla and Apple’s website.
- Apple stated there were no outstanding tasks and requested closure; Mozilla scheduled closure for 1-Sep-2021.
- Apple representative — Apple reported that three EV Sub-CAs were omitted from the WTBR audit statement and provided its incident timeline, remediation steps, and certificate identifiers.
- Community commenter — Ryan Sleevi asked what the current procedures were and questioned why pre-existing controls did not prevent the clerical omission.
- Apple representative — Apple described its formal quality review procedures and explained how two reviewers missed the omitted Sub-CAs due to how the WTBR subsection was structured, then outlined documentation and process updates.
- Apple representative — Apple stated it completed remediation by publishing an amended WTBR audit report, attaching the report to Bugzilla, publishing it on Apple’s website, and updating quality review procedures.
- Apple representative — Apple said there were no outstanding tasks and asked whether the incident could be closed.
- Mozilla representative — Mozilla responded that it would close the bug next Wednesday, 1-Sep-2021.