← Taiwan-CA Inc. (TWCA) cases
Bugzilla #1952639
Audit Finding
TWCA: Missing or Inconsistent Disclosure of S/MIME BR Audits
RESOLVED
FIXED
Taiwan-CA Inc. (TWCA)
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
This case involves Taiwan-CA Inc. (TWCA) addressing a compliance issue regarding the disclosure of S/MIME BR audits. The issue was identified when it was noted that the TWCA CYBER Root CA was missing from the S/MIME audit report. Following discussions, TWCA confirmed that the self-signed root certificate would be included in the audit report after obtaining approval from their auditor. The audit report was subsequently updated and uploaded to the Common CA Database (CCADB) on March 14, 2025. TWCA has committed to stricter scrutiny for future audits and ensuring that all new cross certificates will include the EKU field as per current Baseline Requirements.
Chronology
- Non-compliance identified regarding missing S/MIME BR audit report for TWCA CYBER Root CA.
- Approval obtained to include the TWCA CYBER Root CA in the S/MIME audit report.
- Updated audit report uploaded to CCADB.
Thread Activity
- Taiwan-CA Inc. (TWCA) — Preliminary Incident Report published regarding missing S/MIME BR audit.
- Mozilla representative — Clarified that the self-signed root certificate should not be included in the S/MIME audit report.
- Taiwan-CA Inc. (TWCA) — Confirmed inclusion of the self-signed root certificate in the S/MIME audit report.
- Taiwan-CA Inc. (TWCA) — Report Closure Summary submitted, confirming completion of action items.
Participants
Taiwan-CA Inc. (TWCA)
Mozilla representative
HARICA
Jesperkristensen representative
Community commenter
CCADB representative
External References
Similar Local Cases
Chunghwa Telecom: Findings in 2025 WebTrust Audit - GTLSCA Audit Incident Report #4 - Missing evaluation for third parties
Chunghwa Telecom: Findings in 2025 WebTrust Audit - GTLSCA Audit Incident Report #2 - Domain validation records without the TLS BR version
SwissSign: recommendation on linting software updates
DigiCert: Inconsistent EV audits
SECOM: FUJIFILM intermediate CA Certificate not listed in audit statement
Entrust: Delay in Updating CPS
PKIoverheid: TSP CIBG Findings in 2025 ETSI Audit - Incident Report #5 – Risk Management
Buypass: Findings in 2025 ETSI Audit - Audit Incident Report #2 - Supply chain policy