DigiCert: Late CP/CPS CCADB uploads
DigiCert reported a CCADB compliance issue after reviewing CCADB records. DigiCert noticed that Apple and Microsoft had updated their CPS documents (November 15, 2022 and November 18, 2022, respectively) but that DigiCert had not updated the CCADB records within 30 days of those CPS changes, as expected under the Chrome policy. DigiCert stated that it had subordinate CAs operated externally by Apple and Microsoft that were signed by DigiCert roots with outdated CP/CPS documents in CCADB. In response, DigiCert notified QuoVadis of six subordinate CAs with the same issue, sent Chrome a policy violation notice, and QuoVadis updated the six subordinate CAs. DigiCert also submitted a Certificate Problem Report to Sectigo to report four subordinate CAs operated under Apple with the same issue. DigiCert said it notified all its sub-CA parties that it requires notice in advance of CPS changes so CCADB can be updated timely. The bug was resolved as FIXED, and Mozilla indicated it would close the case unless there were issues or questions.
- Apple updated its CPS document.
- Microsoft updated its CPS document.
- DigiCert noticed outdated CP/CPS documents in CCADB for subordinate CAs operated by Apple and Microsoft and began notifying relevant parties.
- QuoVadis updated six subordinate CAs after being notified.
- DigiCert opened the bug after reviewing CCADB and documenting the CCADB upload timing issue.
- The bug was resolved as FIXED.
- Community commenter — DigiCert (via the bug reporter) explained that after reviewing CCADB it found Apple and Microsoft CPS updates were not reflected in CCADB within 30 days, and provided a timeline and affected certificate references.
- DigiCert — b**********l@digicert.com stated that the notification process from externally operated subCAs on their CP/CPS has been put in place.
- Community commenter — m**********l@gmail.com asked whether there were any other questions and suggested closing the case.
- Mozilla representative — b**********n@mozilla.com said Mozilla would close the bug on or about 13-Feb-2023 unless there were issues or questions.