1582596 - Ernst & Young Virginia: Audit issues

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[Ryan Sleevi]

Attachment: Assessment Report 19-11 GPO Web Trust .pdf

Ernst & Young Virginia issued a WebTrust for CAs Assessment Report to the Government Printing Office of the United States, as disclosed at https://www.oversight.gov/node/20242

The first public version of the report used the boiler plate language from the Illustrative Report, stating
"Subscriber information is properly authenticated (for the registration activities performed by ABC-CA); and"

The correct name of the CA within the report is GPO-CA. As such, the above statement provides no assurances about this specific Principle and Criteria for the activities for GPO-CA.

This was confirmed by the WebTrust Task Force as an oversight, and is being corrected. The original report is attached, as well as the information from https://www.oversight.gov/node/20243 , which names the auditors involved in the preparation and approval of this report.

Related past bugs: Bug 1525441, Bug 1525412, Bug 1525423, Bug 1525446, Bug 1525082

Comment 1

[Ryan Sleevi]

Attachment: Assessment Report 19-12 GPO Federal PKI Compliance.pdf

Comment 2

[Ryan Sleevi]

Wayne: I think you're just closing auditor bugs? I wasn't sure if Kathleen tracked these in CCADB.

Comment 3

[Kathleen Wilson]

(In reply to Ryan Sleevi from comment #2)

I wasn't sure if Kathleen tracked these in CCADB.

Added auditor comment in CCADB. Thanks!

Comment 4

[Wayne Thayer]

(In reply to Ryan Sleevi from comment #2)

Wayne: I think you're just closing auditor bugs?

I've just been leaving them open, but closed if fine as well.

Comment 5

[Ben Wilson]

Based on Comment #4 above, I am closing this bug.