Sectigo: Late CCADB update after CPS update
Sectigo opened this bug to disclose an incident where a newly published Apple CPS was not disclosed to CCADB within the 30-day deadline required by the Mozilla Root Store Policy. The CPS was published by Apple and took effect on November 15, 2022, and it covered multiple Apple subordinate CAs issued by Sectigo (with Apple as the CA operator). Sectigo stated that it received an email on January 11, 2023 indicating that four subordinate CAs had outdated CPS documents in CCADB, and Sectigo then confirmed the new CPS in Apple’s repository and updated the CCADB records with the appropriate URLs and metadata. Sectigo also found that CCADB records for four additional Apple client subordinate CAs contained outdated CPS information and updated those records as well. Sectigo reported that there was no official notification step in the two CAs’ processes for CPS changes, and that Sectigo does not actively monitor Apple’s public repository for updates. Sectigo said discussions with Apple concluded with agreed policy changes: Apple will notify Sectigo no later than 7 days in advance of planned CPS updates and will notify Sectigo once the CPS revision is published to Apple’s public repository. The bug was requested to be marked resolved and was closed as RESOLVED with resolution FIXED.
- Apple published a new CPS that took effect and covered multiple subordinate CAs issued by Sectigo.
- Sectigo received an email indicating CCADB records for certain subordinate CAs listed outdated CPS information.
- Sectigo investigated, confirmed the new CPS in Apple’s repository, and updated CCADB records (including additional subordinate CAs with outdated CPS info).
- Sectigo reached out to Apple to agree on steps to prevent recurrence.
- Mozilla indicated it would close the bug unless additional questions were raised.
- Sectigo — Opened the bug to inform the community of a CCADB disclosure deadline incident involving a newly published CPS not being updated within 30 days.
- Sectigo — Provided a detailed incident timeline and remediation steps, including agreed Apple notification changes to Sectigo.
- Sectigo — Requested marking the bug as resolved unless questions or comments were raised.
- Mozilla representative — Planned to close the bug on or about 10-Feb-2023 unless additional issues were identified.