QuoVadis: Findings in 2024 ETSI Audit of QuoVadis Qualified Web ICA G2
This case reports findings from a 2024 ETSI audit of QuoVadis Qualified Web ICA G2. The bug was created as a preliminary incident report to disclose non-conformities required under Chrome root program requirements, and it states that the findings were confirmed resolved during the audit. The audit was performed by BSI Group The Netherlands B.V. using ETSI standards, and the scope is described as a QuoVadis legacy platform being replaced with an upgraded EU CertCentral platform. Three findings were disclosed: insufficient evidence of periodic firewall rule review documentation, lack of publicly accessible external monitoring information for QuoVadis CRL/OCSP status, and physical access removal after termination not fully effective for two departing employees (with confirmation that they did not access the data center after termination). The thread states that action items for all three findings were marked done and that no findings remained open at the time of the audit walkthrough on August 19, 2024. Mozilla later scheduled closure on or about October 4, 2024, and the bug is resolved as FIXED.
- BSI Group The Netherlands B.V. performed an audit walkthrough and closed the disclosed findings during the audit.
- QuoVadis dated the attestation letter for the audit findings disclosure.
- QuoVadis opened the Bugzilla case with a preliminary incident report and attached the attestation letter.
- Mozilla scheduled the bug to be closed on or about this date.
- DigiCert — Created the bug with a preliminary incident report describing three ETSI audit non-conformities and stating they were resolved during the audit walkthrough on August 19, 2024, with no certificates misissued.
- DigiCert — Asked if there were any questions after noting all items were resolved in the course of the audit.
- DigiCert — Requested closure of the bug unless there were questions, reiterating that the items were resolved during the audit.
- Mozilla representative — Stated they would schedule closure on or about Friday, 4-Oct-2024.