CFCA: Closure report on inaccurate CPR email handling and CPR channel remediation
This case concerns CFCA’s handling of a CPR-related email sent to c**********i@cfca.com.cn and the inaccurate statement later made about that email in Bug 2049179 Comment 2. CFCA said the email address appeared only as supplementary contact text on the CPR web page and was not disclosed in its CPS or CCADB. The report states that the original email was missed during an initial mailbox review because keyword-based search was unreliable in a shared operations mailbox, and that the negative finding was communicated without secondary verification. CFCA also said no certificates were impacted and no revocation was requested. CFCA reported remediation steps including a dedicated CPR address, an updated CPR web form, corrected English text on the CPR page, and a structured mailbox verification procedure with a mandatory secondary check. On 2026-08-08, CFCA posted a closure summary and requested closure, and on 2026-08-09 CCADB posted a final call for comments with a planned closure date of approximately 2026-08-17.
- A community member sent a CPR-related email to c**********i@cfca.com.cn.
- An inaccurate statement about the email was posted in Bug 2049179 Comment 2.
- CFCA located the original email by sender address and date range.
- CFCA implemented corrective measures for the CPR channel, including a dedicated CPR address and secondary check.
- CFCA posted a closure summary and requested closure after stating all action items were complete.
- China Financial Certification Authority (CFCA) — CFCA filed a preliminary incident report saying it failed to identify a CPR-related email sent to a supplementary contact address and that no certificates or revocation were impacted.
- China Financial Certification Authority (CFCA) — CFCA posted the full incident report, described the timeline and impact, and said corrective CPR-channel measures were implemented.
- China Financial Certification Authority (CFCA) — CFCA reported Firefox 151 compatibility test results, said no submission failure was reproduced, and considered the action item resolved unless more details were provided.
- China Financial Certification Authority (CFCA) — CFCA updated the action items, marking the CPR mailbox verification procedure and dedicated CPR email address as complete.
- China Financial Certification Authority (CFCA) — CFCA posted a report closure summary, described the root causes and remediation, and requested closure.
- CCADB representative — CCADB issued a final call for comments and said the report would be closed around 2026-08-17 if there were no further questions.