D-Trust: Delayed publication of audit attestation letters in the CCADB
This case concerns D-Trust GmbH’s failure to upload required Audit Attestation Letter(s) (AALs) to the CCADB within the CCADB Policy deadline of 92 calendar days after the end date of the audit period. The audit period ended on 2025-10-07, the 92-day submission deadline expired on 2026-01-07, and the AALs were uploaded to the CCADB on 2026-01-19. The CCADB policy requirement for a delay greater than 92 days is that the CA Owner provide an explanatory letter signed by the Qualified Auditor, and the auditor TÜV NORD CERT GmbH distributed such an explanatory letter to root store providers on 2026-02-03. In the thread, CCADB/Chrome Root Program participants also raised questions about the policy-version references in the audit statements; D-Trust and its auditor discussed these points and later updated the Audit Attestation Letters to explicitly list all CP/CPS/TSPS document versions and validity periods applicable during the audit period. D-Trust reported process improvements, including an escalation path with deadline monitoring and a resolved CCADB S/MIME capability metadata discrepancy. The bug remains in ASSIGNED status with ongoing monitoring updates reported in later comments.
- D-Trust’s audit period ended.
- The CCADB 92-day AAL submission deadline expired.
- D-Trust uploaded the Audit Attestation Letters to the CCADB.
- The auditor distributed an explanatory letter regarding the late AAL provision to root store providers.
- D-Trust provided revised Audit Attestation Letters explicitly listing all applicable CP/CPS/TSPS versions and validity periods for the audit period.
- D-Trust — Opened a preliminary incident report stating D-Trust uploaded the required AALs on 2026-01-19 after the 92-day deadline expired on 2026-01-07, and cited CCADB Policy 5.2 requirements.
- CCADB representative — Noted that the audit reports had multiple versions and that, for delays beyond 92 days, D-Trust must provide an explanatory letter signed by the Qualified Auditor and improve internal processes.
- D-Trust — Acknowledged the comment.
- D-Trust — Stated D-Trust was in contact with its auditor to submit the Audit Attestation Letter(s).
- D-Trust — Provided a full incident report with the timeline and stated the explanatory letter would be distributed by TÜV NORD CERT GmbH on 2026-02-03.
- D-Trust — Posted the explanatory letter content and links to the AAL PDFs referenced in the letter.
- Google representative — Asked D-Trust to clarify discrepancies about policy-version references in the audit statements and how multiple in-force policy versions were handled.
- Bdr representative — Provided clarifications on why only latest approved policy versions were referenced in the attestation and confirmed the audit covered operational practices across the full audit period.
- Bdr representative — Updated action items, stating escalation path work and resolution of the CCADB S/MIME capability metadata discrepancy were completed.
- Apple representative — Requested that CCADB Policy 5.2 requirements be met, arguing that policy versions effective after the audit period should not be used to show compliance for that period.
- Bdr representative — Stated the Audit Attestation Letters were updated to explicitly list all CP/CPS/TSPS versions and validity periods applicable during the audit period and provided revised AAL links.
- Bdr representative — Reported weekly status: nothing new; D-Trust continues to monitor the ticket.
- Bdr representative — Reported weekly status: nothing new; requested the deadline for the next update be set for October 2, 2026.