1579299 - Asseco DS / Certum: non-audited intermediate certificate

Status: RESOLVED INVALID

(CA Program :: CA Certificate Compliance, task)

Description

[Kathleen Wilson]

Looking at https://crt.sh/mozilla-disclosures#disclosedwithinconsistentaudit I found that the following intermediate certificate is not listed in scope of an audit statement.

This cert either needs to be revoked and added to OnCRL, or needs to be included in scope of appropriate audits and audit statements.

Subject
CN=SSL.com Root Certification Authority RSA; O=SSL Corporation; C=US
Issuer
CN=Certum Trusted Network CA; OU=Certum Certification Authority; O=Unizeto Technologies S.A.; C=PL
SHA-256 Fingerprint
ACF718DF838E640051777D1947F51620E8D804BA186553AE52FC9811B5D34B8B

Comment 1

[Aleksandra Kapinos]

This certificate are showed up in the new audit statement which covered the period March 27, 2018 to 4 March, 2019. Today, we updated the new audit report in CCADB and in Certum website https://www.certum.eu/en/cert_aboutus_about_webtrust/

Comment 2

[Aleksandra Kapinos]

Do you have any additional question in this bug? If not, please close this bug.

Comment 3

[Wayne Thayer]

It appears that this was a false positive. The certificate was issued on 11-Sept 2018 and appears on the audit report covering that date. CCADB still lists this certificate as being covered by the SSL.com audit, but a note states that it is listed in the Certum audit. The CP/CPS information in CCADB lists SSL.com's policies as applying to this certificate, which is correct assuming that SSL.com is in possession of the private key.