Tuntrust: Failure to Respond to April 2023 Survey
The case concerns Tuntrust’s failure to respond to the “Google Chrome Root Program: April 2023 CA Owner Survey” by the required deadline. The Chrome Root Program policy requires CA Owners to respond to CCADB communications within 14 calendar days, and the survey was sent on April 24, 2023 with a response deadline of June 9, 2023. As of June 16, 2023, Tuntrust had not responded, and an incident report was requested in this Bugzilla case. Tuntrust stated that it became aware of the issue when it was notified by email that the Bugzilla bug had been opened, and it prepared the incident report and resumed answering the survey after receiving the incident notification. Tuntrust explained that it could not complete the survey before the deadline due to multiple rounds of stakeholder reviews and discussions, and it submitted its survey answers on June 23. Tuntrust also provided an action plan to prepare an internal procedure for handling browsers’ surveys and communications, including calendarizing review rounds with buffer and building placeholders for communications/escalations; the update marked this action as “Done” as of July 10, 2023. The Mozilla participant indicated on September 26, 2023 that the case could be closed, requesting final comments or questions.
- CCADB sent the “Google Chrome Root Program: April 2023 CA Owner Survey” to CA owners included in the Chrome Root Store.
- The survey response deadline passed without Tuntrust submitting answers.
- Tuntrust was notified that a Bugzilla incident case had been opened for the missed survey response.
- Tuntrust submitted its survey answers.
- Tuntrust updated its action plan status to mark the internal procedure work as done.
- Mozilla indicated the case could be closed pending final comments or questions.
- Google representative — Opened the case noting Tuntrust had not responded to the April 2023 survey by June 9 and requested an incident report.
- Agence Nationale de Certification Electronique — Acknowledged the issue, said it was preparing the incident report and finishing the survey response, and asked whether the original survey link could still be used.
- Google representative — Confirmed the survey link was still accessible.
- Agence Nationale de Certification Electronique — Submitted an incident report describing how Tuntrust became aware of the bug and providing a timeline and explanation for the delay.
- Google representative — Asked for the reason/root cause for missing the deadline, how Tuntrust would avoid repeating the behavior, and why the expected delay was not communicated earlier.
- Agence Nationale de Certification Electronique — Provided answers: explained the delay due to stakeholder review/discussion rounds and resumed after receiving the Bugzilla incident notification; proposed an internal procedure with a target date of July 7, 2023.
- Agence Nationale de Certification Electronique — Updated the action plan, marking the July 7 internal procedure work as done.
- Mozilla representative — Requested any final comments or questions before closing the case.