1688382 - Camerfirma: No disclosure of verification sources

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[Claves Nostrum]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0

Comment 1

[Claves Nostrum]

Camerfirma discloses in its CPS "The documentation necessary to issue a certificate is published at: http://www.camerfirma.com/index/buscador-documentos.php".

The page however returns a HTTP 500 error. Does this breach section 11.1.3 of the EVGL?

Comment 2

[Ana Lopes]

If we are not wrong, that is a link included in an old version of our CPS. If you check the updated official CPS (https://www.camerfirma.com/publico/DocumentosWeb/politicas/CPS_eidas_EN_1.2.12.pdf) you won’t find it anymore.
Could you please let us know where did you find the link so we can manage the issue in order to avoid any misunderstanding?

Comment 3

[Ben Wilson]

I think that the underlying issue is that section 11.1.3 of the Extended Validation Guidelines requires that as of October 1, 2020, CAs have to publicly identify, somewhere in section 3.2 of their CP or CPS, all of their validation sources -- in some form of online data structure. See:

https://github.com/digicert/reports/tree/master/validation-sources
https://www.globalsign.com/en/repository/Incorporating_Agency_and_Registration_Agency_List_v1.3.xlsx
https://sectigo.com/uploads/files/Sectigo-JoI-Data-Source-List-v1_0_13.pdf
https://www.entrust.com/legal-compliance/approved-incorporating-agencies

Comment 4

[Eusebio Herrera]

Thank you Ben.

We will incorporate the information about the Agencies of Registration in the next version of the CPS that we will publish in the next few days.

We will let you know when it is published.

Comment 5

[Eusebio Herrera]

The new version of our CPS which includes information of the Agencies of Registration in section 3.2 is available at
https://rest.camerfirma.com/publico/DocumentosWeb/politicas/CPS_eidas_EN_1.2.14.pdf

Comment 6

[Eusebio Herrera]

We do not have more updates for this bug.

Comment 7

[Eusebio Herrera]

We do not have more updates for this bug.

Comment 8

[Eusebio Herrera]

We do not have more updates for this bug.

Comment 9

[Eusebio Herrera]

Hi Ben,

One month ago we've updated our CPS with information of the Agencies of Registration, we believe this bug can be closed.

Kind regards

Comment 10

[Ben Wilson]

I'll close it this week sometime.