Certigna: Finding #1 ETSI Audit – Missing system configuration information in the CP/CPS
Certigna reported an ETSI audit finding that its CP/CPS did not specify the maximum interval between two checks of system configuration, even though this information existed in its “configuration management procedure.” The non-compliance was identified by an auditor on 2026-02-27 and was treated as an incident disclosed through ETSI audit materials. Certigna stated that there was no impact on certificates and that issuance was not stopped because no certificates were affected. As remediation, Certigna raised awareness among its compliance team and revised and updated the CP/CPS to explicitly specify the maximum interval between system configuration checks in line with its configuration management procedure. Certigna submitted a report closure summary requesting closure after completing the disclosed action items. The bug is marked RESOLVED with resolution FIXED.
- Certigna’s last CP/CPS version did not explicitly include the maximum interval between two system configuration checks.
- An ETSI auditor identified that the CP/CPS omitted the maximum interval between system configuration checks.
- Certigna revised and updated the CP/CPS to specify the maximum interval between system configuration checks.
- The auditor validated the resolution of the deviation.
- Certigna posted a preliminary incident report describing the CP/CPS omission.
- Certigna posted the full incident report findings and a report closure summary requesting closure.
- The incident report was scheduled to be closed and the bug reached RESOLVED/FIXED.
- Dhimyotis representative — Posted a preliminary incident report stating the CP/CPS lacked the maximum interval between system configuration checks required by ETSI EN 319 401, with the information instead in the configuration management procedure.
- Dhimyotis representative — Posted the full incident report with timeline, stating no certificate impact and that remediation included awareness-raising and CP/CPS revisions to explicitly specify the required maximum interval.
- Dhimyotis representative — Submitted a report closure summary stating all disclosed action items were completed and requested closure.
- CCADB representative — Issued a final call for comments and noted the closure would occur approximately 2026-06-02.
- Community commenter — Questioned why the ticket was not posted by the expected CCADB guideline date and referenced the CCADB incident-report posting timing guidance.
- Dhimyotis representative — Acknowledged the timing issue and stated a new incident report was created to address it, linking to bug 2043140.
- HARICA — Commented that a CA might wait a few days after submitting a final incident report to allow community review before publishing a closure summary.
- Dhimyotis representative — Agreed and said future incident reports will wait longer before publishing closure summaries.