SwissSign: recommendation on synchronization of staging and production environments

This case documents an ETSI audit report for SwissSign that included a recommendation to improve synchronization between SwissSign’s staging and production PKI environments. The audit recommendation focused on strengthening the process because SwissSign continued using manual processes to synchronize PKI software configuration and certificate profiles between test and production. SwissSign stated that certificate issuance was not halted because the audit recommendation did not impact issuance. SwissSign implemented automated synchronization from the test environment to production using an “infrastructure as code” approach, with the goal of reducing manual intervention and increasing configuration consistency. SwissSign reported that the action item associated with the audit recommendation was completed and reviewed by its auditors. The incident report was subject to a final call for comments and was scheduled to be closed on approximately 2026-05-04; the bug is currently marked RESOLVED with resolution FIXED.

1. 2025-09-23 An ETSI audit report was published containing a recommendation to improve synchronization between SwissSign staging and production PKI environments.
2. 2025-10-06 SwissSign submitted a full incident report describing the audit recommendation and planned remediation.
3. 2026-04-27 SwissSign completed the action item to implement automated synchronization and reported auditor review; the report closure process began.
4. 2026-05-04 The incident report was scheduled to be closed and the bug status reached RESOLVED.

1. 2025-09-23 SwissSign AG — SwissSign provided a preliminary incident report stating the audit report recommended improving synchronization between staging and production environments.
2. 2025-10-06 SwissSign AG — SwissSign submitted a full incident report, noting the recommendation related to continued manual synchronization and stating issuance was not halted.
3. 2025-10-13 SwissSign AG — SwissSign said it was monitoring the Bugzilla for community feedback.
4. 2025-10-21 SwissSign AG — SwissSign again stated it was monitoring the Bugzilla for community feedback.
5. 2026-04-27 SwissSign AG — SwissSign reported completion of the action item (automated synchronization) and that it was reviewed by its auditors, and requested continued monitoring for community feedback.
6. 2026-04-27 CCADB representative — CCADB issued a final call for comments and stated the incident report would be closed on approximately 2026-05-04.