Entrust audit statement for AffirmTrust and Entrust 4K roots was filed 119 days after period end, with no auditor letter on record

This case concerns Entrust’s audit reporting for the AffirmTrust and Entrust 4K roots. The bug was opened after a CCADB review showed the newest Standard and TLS BR audit period ended on 2025-02-28, but the statement date was 2025-06-27, which is 119 days later. The reporter also noted that no auditor’s letter was on file for the delay, and that the CCADB record had not changed since Sectigo posted draft reports for a later period in November 2025. The thread asks whether a final audit statement exists for the later period, whether a letter for the delay was filed, and which entity now operates the roots for audit purposes. The bug remains UNCONFIRMED.

1. 2025-02-28 The latest Standard and TLS BR audit period for the listed roots ended.
2. 2025-06-27 The audit statement date on record was 119 days after the period end.
3. 2025-11-01 Sectigo posted draft reports for the following audit period to Bugzilla.
4. 2026-10-16 The bug was opened after CCADB showed the audit statement delay and no auditor letter on file.

1. 2026-10-16 Markovianprotocol representative — The reporter cited CCADB Policy 5.2 and Microsoft Trusted Root Program timing requirements, described the 119-day audit statement delay, and asked whether a later final statement or auditor letter exists and who now operates the roots for audit purposes.