← Government of The Netherlands, PKIoverheid (Logius) cases
Bugzilla #1911335
Certificate Problem Report
PKIoverheid: Delayed S/MIME audit report for MoD PKIoverheid G3 CA
CLOSED
FIXED
Government of The Netherlands, PKIoverheid (Logius)
AI Summary
The Dutch Ministry of Defence (NL-MoD) faced a compliance issue regarding S/MIME certificates due to a lack of a valid audit report for the period from September 1, 2023, to September 15, 2024. This gap arose from the absence of a required scope extension audit under ETSI TS 119 411-6, which led to a temporary compliance deficiency. Logius, acting as the Super-CA, ceased S/MIME issuance from the affected CA and conducted a detailed gap analysis. They implemented several operational improvements, including a new self-assessment process for TSPs and enhanced audit planning. The incident was resolved with commitments to ongoing compliance measures.
Chronology
- Adoption of the S/MIME Baseline Requirements.
- Mozilla adopted version 2.9 of the Mozilla Root Store Policy.
- Non-compliance identified.
- Bug filed regarding audit delay.
- Closure statement submitted.
Participants
Jochem van den Berge
Ben Wilson
Malcolm Doody
David Weissenberg
External References
Similar Local Cases
PKIoverheid: Failure to revoke within 7 days: OCSP EKU issue
PKIoverheid: KPN Insufficient Serial Number Entropy
PKIoverheid: CIBG insufficient serial number entropy
PKIoverheid: Incorrect OCSP Delegated Responder Certificate
QuoVadis / PKIoverheid: incorrect OCSP response for precertificate
PKIoverheid: (KPN) Incorrect Subject OrganizationName
PKIoverheid: TSP KPN Findings in 2025 ETSI Audit - Incident Report #4 –Training
Staat der Nederlandend / PKIoverheid: Non-BR-Compliant OCSP Responders