DigiCert: Late background refreshment check
DigiCert reported that its CPS states it performs background checks for trusted role staff at least every 5 years, but during a recent Webtrust review it was noted that 3 of 6 sampled checks were completed between the 5- and 6-year mark. DigiCert stated that the BR’s and root programs do not require this additional background refresh frequency for its public PKI systems, and therefore it reported no impact on public PKI. DigiCert attributed the issue to its CPS not being updated to reflect that the 5-year requirement was no longer applicable, while its people team performed background refreshment every six months for individuals reaching their 5-year anniversary. DigiCert said that depending on when the six-month check ran, the background check could be slightly over the 5-year period, and in this instance the 3 certificates were late by between 2 and 8 months. As a remediation action, DigiCert stated it is removing the background check refresh requirement from its CPS. The bug was marked RESOLVED with resolution FIXED, and DigiCert indicated it was monitoring for community questions before Mozilla closed it.
- DigiCert’s auditors provided draft Webtrust reports noting 3 of 6 sampled background checks completed between 5 and 6 years.
- DigiCert discussed the findings with auditors and agreed it did not track background checks consistently within the 5-year mark.
- Community commenter — Opened the bug describing that DigiCert’s CPS 5-year background refresh requirement was not consistently met (3 of 6 sampled were completed 2–8 months late) and stated it would remove the requirement from the CPS.
- Community commenter — Noted DigiCert was monitoring the ticket for any community questions.
- Community commenter — Asked if Mozilla was okay to close the ticket.
- Mozilla representative — Said they would close the bug on Friday, 1-Dec-2023 unless there were further questions.