Network Solutions: 2021 Audit Observation #2

This case concerns a Network Solutions 2021 audit observation about eight certificates whose modulus was not divisible by 8. The issue was noted in the audit materials referenced by the bug, and Mozilla guidance indicated that Network Solutions was required to file an Incident Report. Network Solutions’ representative stated that the bug should be closed as a RESOLVED DUPLICATE of bug 1653504, citing prior disclosures in other bugs and Mozilla guidance that revocation of these certificates was not required. The thread also discusses why the certificates were mentioned in the audit period and why the audit letter did not reference the related Bugzilla bugs, including that some certificates were disclosed before the audit period and others within it, and that subordinate CAs were treated as out of scope for the Network Solutions audit. The bug was ultimately marked as a duplicate of bug 1653504. No further corrective action beyond the duplicate closure is stated in the thread.

1. 2021-08-10 Bug 1725041 was opened to document a Network Solutions 2021 audit observation about eight certificates with a modulus not divisible by 8.
2. 2021-08-16 Network Solutions provided responses about timing of disclosures and audit scope, and questioned why the audit letter did not reference related Bugzilla bugs.
3. 2021-09-02 Bug 1725041 was marked as a RESOLVED DUPLICATE of bug 1653504.

1. 2021-08-10 Mozilla representative — Ben Wilson noted that eight certificates were issued where the modulus was not divisible by 8, referencing attached materials.
2. 2021-08-10 Mozilla representative — Ben Wilson stated that Network Solutions is required to file an Incident Report and linked Mozilla’s incident reporting guidance.
3. 2021-08-13 Endurance representative — Keith McKenney requested closing the bug as a RESOLVED DUPLICATE of bug 1653504, citing prior disclosures and Mozilla guidance that revocation was not required.
4. 2021-08-16 Mozilla representative — Ben Wilson asked why certificates issued before the audit period were mentioned in the audit period and why the audit letter did not reference the related Bugzilla bugs.
5. 2021-08-20 Endurance representative — Keith McKenney explained that some certificates were disclosed before the audit period and others within it, and that subordinate CAs were treated as out of scope for the Network Solutions audit, with disclosures handled in Sectigo’s audit report.
6. 2021-08-26 Mozilla representative — Ben Wilson said he would close the bug as a duplicate on 1-Sept-2021 unless there were further comments.
7. 2021-09-02 Mozilla representative — Ben Wilson marked the bug as a RESOLVED DUPLICATE of bug 1653504.