PKIoverheid: delayed publication of audit attestation letters in CCADB
This case concerns Logius/PKIoverheid’s failure to upload required Audit Attestation Letters to CCADB within the 92-day deadline for two KPN sub-CAs. Logius said the deadline expired on 2026-08-31, while the relevant letters were uploaded on 2026-09-10 and then updated again on 2026-09-15 to fix the ETSI version information. The incident was self-reported and did not affect certificate issuance. Logius later explained that the root cause was insufficient coordination between Logius, KPN, and the new auditor, TÜV Austria, and said procedures and forms were updated to prevent recurrence. The bug was then moved toward closure after Logius stated that the underlying non-compliance had been addressed and that a separate bug was opened for the delayed incident-reporting issue.
- CCADB 92-day deadline for uploading the audit attestation letters expired.
- Audit attestation letters were uploaded to CCADB for the affected KPN sub-CAs.
- An updated audit attestation letter was uploaded with corrected ETSI version information.
- Logius filed a closure summary stating the action items were complete and requesting closure.
- Logius said the underlying non-compliance was addressed and that delayed incident reporting was being handled in a separate bug.
- Logius representative — Logius opened a preliminary incident report saying the required audit attestation letters were not uploaded to CCADB by the 92-day deadline.
- Logius representative — Logius filed the full incident report, described the timeline, and said no certificates were affected.
- Logius representative — Logius said remediation measures were completed and that it would post a closure statement.
- Logius representative — Logius posted the closure summary, described the root cause, and requested closure.
- CCADB representative — CCADB requested final comments and said the bug would be closed around 2026-10-22 if there were no objections.
- Community commenter — A commenter asked why the preliminary incident report was not published within the required 72-hour timeframe.
- Logius representative — Logius acknowledged the delayed preliminary incident report, said it was a separate obligation, and referenced Bug 2084133 for that issue.
- Logius representative — Logius said the original non-compliance had been addressed and asked that this bug be closed if there were no further concerns.