← iTrusChina Co., Ltd. cases
Bugzilla #1923279
Policy Compliance
iTrusChina: lacking 2018 KGC and GAP period audit report
RESOLVED
FIXED
iTrusChina Co., Ltd.
AI Summary
iTrusChina Co., Ltd. faced an incident due to the absence of the 2018 Key Generation Ceremony (KGC) report and audit reports for the GAP period from July 31, 2018, to October 7, 2018. This was identified as a violation of TLS BR requirements. The issue was discovered by the Chrome Root Program Team in April 2024, leading to iTrusChina conducting supplemental audits and ultimately providing the necessary reports by September 2024. The incident did not impact any subscriber certificates as none were issued during the GAP period. iTrusChina has committed to enhancing its internal processes to prevent future occurrences.
Chronology
- iTrusChina conducted KGC for its two roots witnessed by a Qualified Auditor.
- The issue was discovered by Chris Clements from the Chrome Root Program Team.
- iTrusChina provided the KGC report to Google.
- iTrusChina provided the GAP period audit reports to Google.
- iTrusChina received confirmation from Google that the reports met expectations.
- Incident report closure summary submitted.
Participants
iTrusChina Co., Ltd.
Chris Clements
Mathew Hodson
Levon Shawn
bwilson@mozilla.com
External References
Similar Local Cases
iTrusChina: Failure to Respond to Feb 2026 Chrome Root Program Survey
SwissSign: Missed deadline of publication of 6 CPs and 1 CP/CPS
Chunghwa Telecom: outdated and stale policy documents disclosed to the CCADB
IdenTrust: basicConstraints not flagged "Critical" Per Certification Practices Statement
Microsoft PKI Services: Firewall log data retention
Firmaprofesional: 2020 Audit Report Finding 1 out of 4
Microsoft PKI Services: Failure to modify policy documents within 365 days
TWCA: Missing or Inconsistent Disclosure of S/MIME BR Audits