SwissSign: recommendation on review of key pair generation implementation

This case documents an audit recommendation affecting SwissSign’s key pair generation compliance process. The incident report states that an ETSI audit included a recommendation to improve SwissSign’s regular review of its implementation against NIST SP 800-89 for key pair generation. SwissSign reported that certificate issuance was not halted because the audit recommendation was not treated as a non-compliance event, and SwissSign already checks public keys according to TLS BR 6.1.6 before issuing certificates. The reported root cause was that a formally defined and recurring monitoring process for tracking updates to NIST SP 800-89 had not been explicitly documented in SwissSign’s compliance framework. As remediation, SwissSign implemented a defined and documented monitoring process to track changes to NIST SP 800-89 and to regularly reassess internal key pair generation controls against the specification. The bug was resolved as FIXED, with action items marked done and a final call for comments before closure.

1. 2025-09-23 An audit report containing a recommendation on improving SwissSign’s regular review of key pair generation against NIST SP 800-89 was published.
2. 2026-04-27 SwissSign completed the action item to set up monitoring for NIST SP 800-89 changes and reported remediation completion.

1. 2025-09-23 SwissSign AG — Opened a preliminary incident report stating the audit recommendation concerned improving SwissSign’s regular review of its key pair generation implementation against NIST SP 800-89.
2. 2025-10-06 SwissSign AG — Submitted a full incident report describing the audit recommendation, noting issuance was not halted, and identifying the lack of a formally documented recurring monitoring process for NIST SP 800-89 updates.
3. 2025-10-13 SwissSign AG — Noted that SwissSign was monitoring the Bugzilla for community feedback.
4. 2025-10-21 SwissSign AG — Noted again that SwissSign was monitoring the Bugzilla for community feedback.
5. 2026-04-27 SwissSign AG — Reported completion of the action item to set up monitoring of NIST SP 800-89 changes and provided a report closure summary stating all action items were completed.
6. 2026-04-27 CCADB representative — Issued a final call for comments or questions and stated the incident report would be closed on approximately 2026-05-04.