1015839 - Swisscom Audit Statements

Status: RESOLVED WORKSFORME

(CA Program :: CA Documents, task)

Description

[patrick.graber]

Attachment: 18-12-2013_Letter-Swisscom-EV-Confirmation_English.pdf

User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)

Steps to reproduce:

EV Audit 2013 required by "Mozilla Communication: Action requested by May 30, 2014"

Comment 1

[Kathleen Wilson]

Patrick, 

Please see item #11 of 
http://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/inclusion/

ETSI TS 101 456 is OK for non-SSL cert issuance, but the 3 Swisscom roots that are included have the websites (SSL) trust bit enabled. So they need an audit statement according to the following criteria:
- Clause 7, "Requirements on CA practice", in ETSI TS 102 042 V2.3.1 or later version, Policy requirements for certification authorities issuing public key certificates (as applicable to the "EVCP" and "EVCP+" certificate policies, DVCP and OVCP certificate policies for publicly trusted certificates - baseline requirements, and any of the "NCP", "NCP+", or "LCP" certificate policies);
OR
- WebTrust "Principles and Criteria for Certification Authorities 2.0" or later and "SSL Baseline Requirements Audit Criteria V1.1" (as applicable to SSL certificate issuance) in WebTrust Program for Certification Authorities;

And (additional) for the EV root:
- WebTrust "Principles and Criteria for Certification Authorities - Extended Validation Audit Criteria 1.4" or later in WebTrust Program for Certification Authorities.

Also, please see item #12 of 
http://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/inclusion/
Which requires an audit according to the CA/Browser Forum's Baseline Requirements (https://cabforum.org/baseline-requirements-documents/) for roots that have the websites trust bit enabled.

https://wiki.mozilla.org/CA:CertificatePolicyV2.1#Audit_Criteria

The audit statements must clearly indicate which criteria (and version of the criteria) was used in the audit, and which roots and intermediate certificates were evaluated during the audit.

Comment 2

[patrick.graber]

Attachment: To the Certification Authority staff andManagement of Swisscom (Schweiz) AG

Please find the required audit statement.

Comment 3

[Kathleen Wilson]

Closing this bug, but this bug will continue to be used for tracking Swisscom's current ETSI TS 102 042 audit statements.

Comment 4

[Kathleen Wilson]

Attachment: Management_Assertion_SDCS_2014_signed.pdf

Comment 5

[Kathleen Wilson]

Attachment: Swisscom_CSP_Zertifikat_2014.pdf

Comment 6

[Kathleen Wilson]

Attachment: Swisscom_EV-SSL_Cert_Confirmation_2015_signed.pdf

Comment 7

[Kathleen Wilson]

Attachment: 2016-08-05-Swisscom-EV-SSL-Certification-Confirmation.pdf

Comment 8

[Kathleen Wilson]

Attachment: 2016-08-15-Swisscom-EV-SSL-Certification-Confirmation.pdf

New version of the audit statement explicitly mentioning which root certificates were covered in the audit.

Comment 9

[Kathleen Wilson]

(In reply to Kathleen Wilson from comment #8)
> Created attachment 8781165 [details]
> 2016-08-15-Swisscom-EV-SSL-Certification-Confirmation.pdf
> 
> New version of the audit statement explicitly mentioning which root
> certificates were covered in the audit.

I have exchanged email with the auditor to confirm the authenticity of this audit statement.

Comment 10

[H-P Waldegger]

Attachment: 2017 Swisscom Root CA Audit confirmation eIDAS

Comment 11

[H-P Waldegger]

Comment on attachment 8908071 [details]
2017 Swisscom Root CA Audit confirmation eIDAS

I added also a signed copy, check attachment "2017 Swisscom Root CA Audit confirmation eIDAS (signed)"

Comment 12

[H-P Waldegger]

Attachment: 2017 Swisscom Root CA Audit confirmation eIDAS (signed)

Confirmation of the 2017 ETSI audit for Root CA 2 and the EU Saphir and EU Diamant CAs.

Comment 13

[H-P Waldegger]

Attachment: 2018 Audit Confirmation Diamant, Smaragd, Rubin

Comment 14

[H-P Waldegger]

Attachment: CP/CPS Diamant and Saphir 3.2 English

CP/CPS Diamant and Saphir 3.2 English.pdf

Comment 15

[H-P Waldegger]

Attachment: CP/CPS Smaragd and Rubin v3.1 English

CP/CPS Smaragd and Rubin v3.1 English

Comment 16

[H-P Waldegger]

Attachment: 2018_Audit Confirmation Statement Swisscom_EU_Diamant_Saphir.pdf

Swisscom Root CA 2, Swisscom Diamant EU CA 4 and Swisscom Saphir EU CA 4 Audit Attestation by KPMG for Swisscom IT Service Finance S.E. ATU64741248