OISTE: CCADB disclosure of EV test website URLs corrected after third-party report
This case concerns a third-party Certificate Problem Report about OISTE’s CCADB records for EV test websites. The reporter said the disclosed URLs pointed to non-EV test endpoints and that the required EV test webpages were not properly identified in CCADB. OISTE said it did maintain separate EV, DV, and OV test endpoints for each of the four EV-capable roots, and that the issue was the way the URLs were disclosed in CCADB rather than a failure to host the test pages. After receiving the report, OISTE updated the CCADB records so the generic test website fields point to the EV endpoints it was already hosting. OISTE also said it raised the disclosure ambiguity with the CCADB community and proposed clearer guidance or dedicated EV test website fields. The bug remains ASSIGNED, and OISTE requested assessment of the report as INVALID subject to review of the evidence and disclosure requirements.
- OISTE received a third-party CPR about EV test website URLs disclosed for four EV-capable root certificates.
- OISTE updated the CCADB records so the generic test website URLs identify the EV endpoints already being hosted.
- OISTE raised the disclosure ambiguity with the CCADB community and proposed clearer guidance or dedicated EV test website fields.
- OISTE — Reported that a CPR said OISTE did not publish the required EV test webpages, and stated the company actually hosted them but CCADB linked to non-EV test websites.
- OISTE — Said the CCADB records were updated so the test websites are specifically the EV ones already being hosted.
- OISTE — Filed the full incident report, described the third-party CPR, and requested an INVALID disposition while noting the CCADB disclosure ambiguity.