certSIGN: Findings in 2025 ETSI Audit - Audit Incident Report #1 – Improve clarity in CPS
This case is an audit incident report from certSIGN following findings from a 2025 ETSI audit related to the clarity of its CPS. The finding was that, in the CPS “certSIGN Web CA for QWAC & EV Certificates,” the association of each policy identifier with each specific OID was not explicit in chapter 1.3.1, because the policy identifiers acronyms were not specified in the CPS schema. The auditors requested that the acronyms (including ‘EVCP’ and ‘QEVCP-w’) be added to the schema, even though the policies were already specified elsewhere (Table 7.6). certSIGN stated there was no impact because no certificates were affected and issuance was not stopped. certSIGN published an updated CPS version (1.32) with the requested acronym clarity changes effective 30-Apr-2025. The report includes lessons learned and action items, and certSIGN requested closure after stating all actions were completed; the CCADB incident reporter issued a final call for comments before closure.
- ETSI audit attestation letters were received identifying a CPS clarity finding for the QWAC & EV CPS.
- certSIGN published CPS version 1.32 for “certSIGN Web CA for QWAC & EV Certificates” with the requested schema clarity updates.
- certSIGN submitted a closure report stating the incident actions were completed and requested closure.
- certSIGN — Opened the full incident report describing the CPS schema clarity finding, the requested acronym additions, and the remediation timeline, and set the bug resolution to FIXED.
- certSIGN — Noted updates requested in another related bug (1965807), including appending the title and adjusting fields such as “Source of incident disclosure” and the timeline.
- certSIGN — Proposed to close the report, stating all actions were completed.
- certSIGN — Submitted a closure report summarizing the incident, root cause, remediation, and commitment to add verification to the internal audit plan.
- CCADB representative — Issued a final call for comments or questions and stated the incident report would be closed approximately 2025-06-11.