Pakistan ECAC: Documents for Root CA

This case is for Pakistan’s Electronic Certification Accreditation Council (ECAC) to provide documents for its Root CA. ECAC states it is using Bugzilla to store the required documents and obtain URLs for use in the CCADB. The documents are intended for the “CCADB Access Request for New CA” application to enroll the ECAC Root CA in CCADB. ECAC specifically provides WebTrust/assurance materials from a Qualified Auditor (WebTrust practitioner) that opine the organization’s CA followed its key ceremony during key and certificate generation and that controls ensured key pair integrity and confidentiality. ECAC also notes that the same WebTrust report is available on the CPA Canada WebTrust seal page and provides the corresponding URLs, including an ECAC public repository link. The bug is currently in ASSIGNED status, with multiple audit/assurance report attachments created over time.

1. 2024-01-31 ECAC opened a Bugzilla case to provide WebTrust assurance and management assertion documents for enrollment of its Root CA in CCADB.
2. 2024-03-01 ECAC added an additional key generation assurance report attachment for its Root CA documentation set.
3. 2025-07-15 ECAC added an updated independent report attachment for CA documentation.
4. 2025-07-29 ECAC added an independent assurance report attachment specifically for Root key generation.

1. 2024-01-31 Pki representative — Created the initial attachment for “ECAC WebTrust for CA - Assurance Report & Management Assertion” and explained it is required for the CCADB access request for enrolling the ECAC Root CA, including a CPA Canada WebTrust seal URL.
2. 2024-01-31 Pki representative — Provided the CPA Canada WebTrust seal link and stated it can also be accessed from the ECAC public repository URL.
3. 2024-03-01 Pki representative — Created and attached a “Key Generation - Assurance Report - ECACv1_signed.pdf” audit report from a Qualified Auditor.
4. 2025-07-15 Pki representative — Created an attachment named “ECAC_Independent_Report_for_CA_2024_v4.pdf”.
5. 2025-07-29 Pki representative — Created an attachment named “ECAC_Root_key_generation_Independent_Assurance_Report_Crowe_2025-01-24-v3_signed.pdf”.