1706976 - Google Trust Services: Out-of-date CPS disclosure

Status: RESOLVED INVALID

(CA Program :: CA Certificate Compliance, task)

Description

[Andrew Ayer]

GTS has disclosed in CCADB that their root https://crt.sh/?sha256=CA42DD41745FD0B81EB902362CF9D8BF719DA1BD1B1EFC946F5B4C99F42C1B9E operates under the following CPS, which is versioned v2.22 and dated 2020-08-21: https://pki.goog/repo/cps/2.22/GTS-CPS.pdf

However, https://pki.goog publishes a newer CPS (versioned v3.0 and dated 2021-03-19) for this root: https://pki.goog/repo/cps/3.0/GTS-CPS.pdf

This is a violation of CCADB Policy Section 5 (incorporated by reference into Mozilla Root Store Policy), which requires that the URLs for CPSes be updated in CCADB as new information become available.

Comment 1

[Andy Warner]

GTS acknowledges this report. Other roots were updated in CCADB on March 25th, we need to determine what happened with the GS R2 update. An incident report is being prepared with full details.

Comment 2

[Ben Wilson]

Currently, CAs do not have the ability to update their CPs and CPSes without additional intervention from the root store member of the CCADB.

Comment 3

[Ben Wilson]

This may have been an oversight on my part in not identifying the root CA involved. I think I have updated/corrected the CCADB record. I'm going to mark this bug as invalid.