← Government of The Netherlands, PKIoverheid (Logius) cases
Bugzilla #1843265
Incident
PKIoverheid: Delayed audit statements for intermediate CAs
RESOLVED
FIXED
Government of The Netherlands, PKIoverheid (Logius)
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
The case involves PKIoverheid's delayed audit statements for intermediate CAs, which were discovered during preparations for an annual ETSI audit. Logius, the CA operator, identified that newly issued CAs were not included in the audit scope, violating Mozilla's Root Policy. After discussions with DigiCert and QuoVadis, Logius disclosed the issue in Bugzilla as required. Remediation actions included updating incident handling procedures and ensuring compliance with audit requirements. The audit statement has since been received and will be uploaded to the CCADB.
Chronology
- Logius filed a Bugzilla report regarding delayed audit statements.
- Logius received the audit statement from DigiCert + QuoVadis.
Thread Activity
- Logius representative — Logius reported the issue of delayed audit statements for intermediate CAs.
- Logius representative — Logius outlined remediation actions including a new checklist for compliance.
- Logius representative — Logius confirmed receipt of the audit statement from DigiCert + QuoVadis.
Participants
Logius representative
Community commenter
Mozilla representative
External References
Similar Local Cases
PKIoverheid: Delayed S/MIME audit report for MoD PKIoverheid G3 CA
PKIoverheid: CIBG insufficient serial number entropy
PKIoverheid: Compliance issues CIBG TLS certificates
PKIoverheid: KPN Insufficient Serial Number Entropy
PKIoverheid: No BR Audit for Intermediate CAs technically capable of issuing TLS certs
QuoVadis / PKIoverheid: incorrect OCSP response for precertificate
PKIoverheid: TSP KPN Findings in 2025 ETSI Audit - Incident Report #3 – Internal Audit
PKIoverheid: TSP KPN Findings in 2025 ETSI Audit - Incident Report #4 –Training