Asseco Data Systems (Certum): Failure to Update Policy Documents within 365 Days
This case reports that Certum (Asseco Data Systems S.A.) did not update its Certification Policy (CP) and/or Certification Practice Statement (CPS) within the required 365-day timeframe. A Certum employee reviewed the CCADB on December 3, 2024 and found that the current Certification Policy was older than 365 days, after a website update. The CA stated that this violated Section 2.3 of the Baseline Requirements and Section 4 of the Mozilla Root Store Policy, which require CP/CPS updates at least once every 365 days. Certum reported the incident on Bugzilla and said the incident did not affect the certificate issuance process. Certum released Certification Policy v.5.1 on December 6, 2024, revised its documentation update procedure, created an internal tracker, and reported a technical problem with updating CP in CCADB. Certum later stated that all disclosed action items were completed and requested closure of the incident report; the bug is resolved as FIXED.
- Certum Certification Policy v.5.0 was published in the Certum repository.
- A Certum employee reviewed CCADB and identified that the current Certification Policy was older than 365 days.
- Certification Policy v.5.1 was released.
- Certum revised its CP/CPS update procedure and created an internal tracker for CP/CPS updates.
- Certum reported a technical problem with updating CP in CCADB to CCADB support.
- Certum completed implementation of a script to compare CP/CPS in CCADB public reports and alert before expiration.
- Assecods representative — Certum reported that its current Certification Policy was older than 365 days, citing Baseline Requirements and Mozilla Root Store Policy update requirements, and committed to provide a full report by December 17, 2024.
- Assecods representative — Certum provided an incident report with impact (no effect on certificate issuance), timeline, root cause (gaps in internal procedures and manual handling by one person), and remediation action items.
- Assecods representative — Certum stated that all action items were completed and that it was monitoring the bug for community questions.
- Assecods representative — Certum requested closure, summarizing the missed annual CP update requirement, the root cause, the remediation steps (revised procedure, internal tracker, and automated script), and confirming action items were completed.