DigiCert corrected CCADB policy listings for Apple-controlled issuing CAs and related externally operated subCAs
DigiCert opened this bug to report that some CCADB entries for Apple-controlled issuing CAs had the wrong CP value: the CP field pointed to Apple’s private CP instead of a public-trust CP. DigiCert said the issue was first noticed after a Sectigo employee raised it on 2024-10-15, and that the CPS field was already correct. The thread then focused on what CP should be listed in CCADB for these hierarchies, including discussion of the Baseline Requirements, combined CP/CPS documents, and how audits treat CP versus CPS. DigiCert later updated the CCADB entries, and the discussion expanded to related externally operated subCAs, including Microsoft and Apple records. By the end of the thread, DigiCert said the remaining remediation was for Apple to draft and publish a combined CP/CPS, and Mozilla asked for a closing summary.
- DigiCert created Apple issuing CAs and uploaded an Apple private CP into CCADB for the CP field.
- A Sectigo employee notified DigiCert that the CP field in DigiCert’s Apple CCADB entries pointed to Apple’s private CP.
- DigiCert updated the CCADB CP listing to use the DigiCert CP instead of the Apple CP.
- DigiCert said Microsoft’s externally operated subCA entries had been updated to point to the Microsoft CP and CPS.
- DigiCert posted the closure summary and said there were no additional updates.
- DigiCert — DigiCert filed a preliminary incident report saying it would provide updates and a full report by October 30.
- DigiCert — DigiCert said Apple had sole physical control of the private keys and that the Baseline Requirements were the most appropriate certificate policy to reference.
- DigiCert — DigiCert posted the full incident report, explaining the incorrect CP had been uploaded in 2018 and updated annually thereafter.
- Mozilla representative — Ben Wilson recused himself after noting a potential conflict of interest from having populated the CCADB entry in 2018.
- DigiCert — DigiCert said auditors check the CPS and relevant industry CP, not the CP itself, and stated it had updated the CCADB entries.
- DigiCert — DigiCert committed to regular reviews of CCADB accuracy and said it had added automation to check CP/CPS accuracy.
- DigiCert — DigiCert said it was working on a standalone TLS CP for third-party sub CAs and expected completion by March 31.
- DigiCert — DigiCert said the current CCADB listing of DigiCert CP/CPS in the CP field and Apple CPS in the CPS field was the most accurate depiction for now.
- DigiCert — DigiCert said Microsoft’s externally operated subCA entries had been updated and that Apple’s combined CP/CPS was the remaining remediation item.
- DigiCert — DigiCert posted the closure summary and said there were no additional updates.