Microsoft PKI Services: Failure to modify policy documents within 365 days

DigiCert notified Microsoft PKI Services that its CCADB policy documents were more than 365 days old. Microsoft investigated and confirmed that its Certificate Policy (CP) and Certification Practice Statement (CPS) had not been updated within the 365-day requirement. Microsoft stated that it had not stopped certificate issuance, and that this was a compliance problem that did not directly impact certificate issuance or cause harm to issued certificates while updated documents were published. Microsoft finalized updated CPS and CP documents in January/February 2022, and after DigiCert’s notification it finalized and published new versions on 2023-02-22 and posted the updated documents to CCADB. Microsoft also added and tested a basic monitoring and alerting script as a safety net to notify if updates are missed by future human review. The bug thread indicates no certificates were in scope for this case, and Mozilla planned to close the bug on or about 8-Mar-2023. The bug is marked RESOLVED with resolution FIXED.

1. 2022-01-19 CPS updates were finalized.
2. 2022-02-15 CP updates were finalized.
3. 2023-02-14 DigiCert notified Microsoft that CCADB policy documents were more than 365 days old.
4. 2023-02-22 Microsoft finalized and published updated CP/CPS documents and posted them to CCADB, and added monitoring/alerting.
5. 2023-03-08 Mozilla closed the bug on or about this date.

1. 2023-02-15 Disabled representative — Microsoft reported that DigiCert notified it that CCADB policy documents were over 365 days old, confirmed the issue, stated no certificates were in scope, and said it was still investigating remediation details.
2. 2023-02-22 Microsoft Corporation — Microsoft provided an updated timeline, stated the CP/CPS were updated and published on 2023-02-22, posted updated documents to CCADB, and described a manual-process failure and added monitoring/alerting.
3. 2023-03-01 Disabled representative — Microsoft asked whether anything else was needed before the bug could be closed.
4. 2023-03-06 Mozilla representative — Mozilla indicated it would close the bug on or about Wed. 8-Mar-2023.