PKIoverheid: TSP KPN Findings in 2025 ETSI Audit - Incident Report #16 – EJBCA Configuration
This case is an incident report from PKIoverheid (Policy Authority PKIoverheid) regarding a 2025 ETSI audit finding about EJBCA configuration. The incident was disclosed through the annual ETSI audit and described as a minor non-conformity: certain certificate profiles implemented by KPN were not in line with the CP/CPS (Programme of Requirements PKIoverheid/CPS KPN B.V.). The report states that the non-conformity related to certificate profile configuration changes not being consistently checked across the CA and CMS applications, where a change processed in the CA software was later reversed in another scheduled check. PKIoverheid/KPN remediation included correcting the profile configuration to align CA and CMS, updating work instructions for profile changes to include a verification step for alignment with the profile document, and implementing periodic checks to monitor and report on profile alignment. The report closure summary states that all disclosed action items were completed and requests closure. The bug is marked RESOLVED with resolution FIXED.
- A certificate profile change was documented and partially implemented.
- An auditor identified ETSI Finding #16 regarding EJBCA/certificate profile configuration.
- A Corrective Action Plan was created for the finding.
- The Corrective Action Plan was approved by the auditor.
- All open action items were completed and a closure request was planned.
- The incident report bug was resolved (FIXED).
- Logius representative — Opened a preliminary incident report describing a minor non-conformity: EJBCA configuration not in line with the documented profile, citing ETSI 411-1.
- Logius representative — Provided the full incident report details, including that CAB/auditor noted certificate profiles implemented by KPN were not in line with the CP/CPS, and listed action items and root cause analysis.
- Logius representative — Stated PKIoverheid was monitoring the bug and had no updates on the action items at that time.
- Logius representative — Updated that action items #1 and #2 were still in progress with a delay, while action item #3 had been completed.
- Logius representative — Reported that action items #1 and #2 were completed and that a closure request would be submitted shortly, while remaining open to questions.
- Logius representative — Submitted a report closure summary stating remediation steps taken, that all action items were completed, and requested closure.
- CCADB representative — Issued a final call for comments and stated the report would be closed on approximately 2025-11-19 if no further comments were received.