Chunghwa Telecom (GTLSCA): WebTrust audit finding—domain validation records missing structured TLS Baseline Requirements version field (GTLSCA Audit Incident Report #2)
This case documents a WebTrust audit finding for Chunghwa Telecom’s GTLSCA (CA owner CCADB unique ID A006506) during the 2025 audit period. The auditors identified that, when creating domain validation records, the recorded information did not include the applicable TLS Baseline Requirements (BR) version number used to validate every domain on the RA system. The CA stated this was an issue with incomplete record-keeping information (record structure and retention/mapping practices), not an error in the domain validation workflow or any certificate misissuance. The CA reported that issuance was not stopped because there were no certificates misissued, and it also stated it had already stopped issuing TLS certificates in early March 2025. As remediation, the CA added a new system-required field to the RA validation record schema to explicitly record the applicable BR version (along with validation method and MPIC Perspectives result) and implemented system-level integrity checks to ensure required validation metadata is present and consistent. The CA reported that there were no remaining open deliverables for the incident and requested closure; the bug is marked RESOLVED with resolution FIXED.
- Non-compliance period began when TLS BR version 1.5.2 became effective and the RA system’s validation record design did not require BR version as a structured field.
- The issuance date of GTLSCA’s first TLS certificate.
- The non-compliance was identified during the GTLSCA 2025 audit period (auditing close meeting).
- The CA completed an RA program update to fix validation logs so the applicable TLS BR version was specified.
- The incident report was closed after Mozilla’s final observations and the CA’s response.
- Cht representative — Submitted a preliminary incident report describing the audit finding that domain validation records lacked the TLS Baseline Requirements version number.
- Cht representative — Submitted a full incident report with details including non-compliance dates, scope (record-keeping completeness), and remediation timeline.
- Cht representative — Noted Chunghwa Telecom was monitoring the bug for comments/questions and had no new information.
- Cht representative — Again stated Chunghwa Telecom was monitoring the bug and had no new information.
- Cht representative — Provided a report closure summary stating the issue was limited to how validation records were stored/displayed and describing remediation (structured BR version field and integrity checks).
- CCADB representative — Issued a final call for comments and stated the incident would be closed approximately 2026-02-10.
- Mozilla representative — Shared Mozilla observations emphasizing the control-design maturity aspect and the need for proactive internal compliance validation.
- Cht representative — Agreed with Mozilla’s broader characterization and described additional emphasis on reassessing system designs and strengthening requirement-to-system translation.