Chunghwa Telecom: outdated and stale policy documents disclosed to the CCADB
Chunghwa Telecom (CHT) reported that the policy documents disclosed to the CCADB were not kept up to date, including the URL of its new repository. CHT stated that this caused users to access outdated and stale policy documents via public websites (e.g., crh.sh). CHT said the failure resulted in a violation of the Chrome Root Program Policy and CCADB Policy, but that no security incidents or certificate misuse occurred during the delay. CHT attributed the issue to an oversight during CA information updates: while CPS documents were updated in its new repository, processing staff took leave and did not complete the CCADB update in parallel, and no proxy was assigned to take over. After the discrepancy was identified and following notification from the Chrome Root Program, CHT updated the CCADB with the new CA repository URLs and the CPS documents and re-submitted for review. The bug was resolved as FIXED, and CHT reported that it would continue monitoring and improve its processes to keep CCADB data synchronized with its public repositories.
- Chrome Root Program notified CHT that the policy documents disclosed to CCADB were outdated and stale.
- CHT updated the Self-Assessment version number and re-submitted the CCADB case for review.
- CHT updated CCADB with the new repository URLs and CPS documents; the case was reviewed and closed.
- Cht representative — CHT filed an incident report describing outdated/stale policy documents in CCADB, the impact, root cause, and remediation actions, and requested closure.
- Cht representative — CHT stated it was continuing to monitor the issue.
- Cht representative — CHT stated it was continuing to monitor the issue.
- Cht representative — CHT stated it was continuing to monitor the issue.
- Cht representative — CHT stated it was continuing to monitor the issue.
- Cht representative — CHT stated it was continuing to monitor the issue.
- Cht representative — CHT stated it was continuing to monitor the issue.
- Cht representative — CHT stated it was continuing to monitor the issue.
- Cht representative — CHT provided a report closure summary stating action items were completed and requested closure.
- Mozilla representative — Mozilla stated it would close the issue on or about 11-Apr-2025 unless questions remained.