Telia: Findings in 2023 Audit
This case documents findings from Telia’s qualified opinion WebTrust annual audit report dated June 28, 2023. The audit reported that the TeliaSonera Root CA v1 root certificate did not meet Principle 2, Criteria 2.3 of the WTBR v2.7, specifically stating that the Key Usage extension was not marked critical and that the certificate subject information did not include subject:countryName. Telia stated this was a recurring issue introduced earlier in a referenced incident (bug 1649683). As remediation, Telia explained that TeliaSonera Root CA v1 was created in 2007, before CA Browser Forum Baseline Requirements and WebTrust conformance assurance requirements were effective, and that Telia has been transitioning to Telia Root CA v2. Telia described a transition plan to gradually move subscribers from the old root CA hierarchy to the new root CA hierarchy and to cease operation of TeliaSonera Root CA v1 in the future, transitioning TLS issuance to intermediate CAs under Telia Root CA v2 completely. The bug was resolved as FIXED, with a note that it would be closed on Friday, 29-Sept-2023.
- Telia’s WebTrust annual audit report identified non-conforming properties in the TeliaSonera Root CA v1 certificate.
- Telia opened the CA Program bug to report the 2023 audit findings and remediation/transition approach.
- Telia provided a status update describing a twofold remediation plan and subscriber transition expectations.
- The bug was scheduled to be closed.
- Teliacompany representative — Antti Backman reported that TeliaSonera Root CA v1 failed WTBR v2.7 Principle 2, Criteria 2.3 due to non-critical Key Usage and missing subject:countryName, and described a remediation/transition plan to Telia Root CA v2.
- Mozilla representative — Ben Wilson asked for a status update on all remediation efforts.
- Teliacompany representative — Antti Backman responded with a twofold remediation plan: relying on pending root program inclusions for Telia Root CA v2 and managing customer transition timing via cross-signed support for Telia Root CA v2.
- Mozilla representative — Ben Wilson asked whether anyone knew a reason the bug cannot be closed.
- Mozilla representative — Ben Wilson stated they would close the bug on Friday, 29-Sept-2023.