certSIGN: Findings in 2025 ETSI Audit - Audit Incident Report #3 – Missing certSIGN OID on Terms and Conditions
This case documents an ETSI audit finding for certSIGN where an EV-certificate OID (1.3.6.1.4.1.25017.3.1.4.6) was present in the certSIGN Web CA CPS but missing from the certSIGN Web CA Terms and Conditions. The issue was identified on 29-Apr-2025 and was described as an inconsistency between the OIDs listed in the CPS and those listed in the T&C. certSIGN stated there was no impact because no certificates were affected and there were zero remaining valid certificates. The root cause analysis attributed the mismatch to a delay in updating the T&C due to business reasons after the CPS was updated. certSIGN’s remediation actions included correcting the T&C and synchronizing the CPS and T&C OID lists, with a commitment to add an ongoing verification to the yearly internal audit plan. The bug was resolved as FIXED, and certSIGN requested closure after stating all disclosed action items were completed.
- certSIGN published an updated CPS that added the EV certificate OID 1.3.6.1.4.1.25017.3.1.4.6.
- An ETSI audit finding was identified regarding the EV OID being missing from certSIGN Web CA Terms and Conditions.
- certSIGN approved and published the updated Terms and Conditions including the EV OID.
- certSIGN — Opened the full incident report finding describing the missing EV OID in the Terms and Conditions versus the CPS, stating there was no impact and listing root cause, timeline, and action items.
- certSIGN — Updated the Bugzilla fields per a request from the chrome-root-program, including appending the title and adjusting the source/timeline/action-item wording.
- certSIGN — Proposed closure after stating the actions were completed.
- certSIGN — Submitted a closure report stating the remediation was to synchronize CPS and T&C OID lists and that the internal audit plan verification commitment was added; requested closure.
- CCADB representative — Posted a final call for comments and indicated the incident report would be closed approximately 2025-06-11.