1728790 - eMudhra: Audit Delay

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[Vijay Kumar]

Attachment: Auditor Letter to Trust Stores - Delay

Summary:
This incident submission is related to the delay encountered by emSign CA (eMudhra) in submission of Audit Statements. Our annual audit period for all emSign CAs runs from June 1st of one year to May 31st of the following year. Current year audit was commenced on time, and was aimed to close by end of July-2021. However, sporadic local lockdowns in India due to second wave and other travel restrictions caused some delays. Mozilla Policy (https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay) requires the latest statements to be “provided to Mozilla via the CCADB within three months of the point-in-time date or the end date of the period”. We had one month buffer time to the cut-off date of 31-Aug-2021 (compared to estimated completion date of July end), and were in continuous coordination with our auditor. However, the final seals are still not available. This week, auditor has expressed uncertain delays being encountered (attached letter) and given estimated date of third week of Sep-2021, for availability of Statements / Seals. In the meanwhile, Auditor has confirmed of successful completion of Audit via the report dated 27-Aug-2021. These are expected to be published through Webtrust Seals / CPA Canada.

How your CA first became aware of the problem (e.g. via a problem report submitted to your Problem Reporting Mechanism, a discussion in mozilla.dev.security.policy, a Bugzilla bug, or internal self-audit), and the time and date.
We became aware of the problem (delay) during August, but were in coordination with Auditor for timely closure.

A timeline of the actions your CA took in response. A timeline is a date-and-time-stamped sequence of all relevant events. This may include events before the incident was reported, such as when a particular requirement became applicable, or a document changed, or a bug was introduced, or an audit was done.
Current Audit period: 01-Jun-2020 to 31-May-2021
Audit Commencement Date: 08-Jun-2021
Audit Report Date: 27-Aug-2021
Audit Statement Publication / Webtrust Seals: Expected by third week of Sep-2021

Whether your CA has stopped, or has not yet stopped, issuing certificates with the problem. A statement that you have will be considered a pledge to the community; a statement that you have not requires an explanation.
Not applicable for this issue.

A summary of the problematic certificates. For each problem: number of certs, and the date the first and last certs with that problem were issued.
Not applicable for this issue.

The complete certificate data for the problematic certificates. The recommended way to provide this is to ensure each certificate is logged to CT and then list the fingerprints or crt.sh IDs, either in the report or as an attached spreadsheet, with one list per distinct problem.
Not applicable for this issue.

Explanation about how and why the mistakes were made or bugs introduced, and how they avoided detection until now.
The current Covid-19 pandemic is unprecedented. The current restrictions and international travel in the region has impacted the usual timelines for audit procedures for both emSign and the Auditor.

List of steps your CA is taking to resolve the situation and ensure such issuance will not be repeated in the future, accompanied with a timeline of when your CA expects to accomplish these things.
Current Audit Statement submission to CCADB website is expected to be completed maximum by third week of September 2021. We are working with Auditor to follow and adhere to this timeline. For future audits, we are expecting the situation to be much better. We understand the criticality of timely audit closure and have been working on improving the timelines with Auditors, even in the situations like this. emSign Policy Authority is vigilant towards this direction.

Comment 1

[Vijay Kumar]

Attachment: 1. WebTrust for CA - Independent Assurance Report 270821v1.pdf

Comment 2

[Vijay Kumar]

Attachment: 2. SSL Baseline w Network Sec - Independent Assurance Report 270821v1.pdf

Comment 3

[Vijay Kumar]

Attachment: 3. EVSSL - Independent Assurance Report 270821v1.pdf

Comment 4

[Vijay Kumar]

Attachment: 4. PTCS - Independent Assurance Report 270821v1.pdf

Comment 5

[Vijay Kumar]

Attachment: 5. EVCS - Independent Assurance Report 270821v1.pdf

Comment 6

[Vijay Kumar]

As an update to this thread, there is no change in the status of Webtrust Seals arrival, and we are waiting for the update from our Auditor (estimated by third week of Sep-2021).

In the meanwhile, we are herewith attaching our 2021 WebTrust audit reports as received from our Auditor. Mozilla Policy (https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay) requires the latest statements to be “provided to Mozilla via the CCADB within three months of the point-in-time date or the end date of the period”. However, as reported in this incident, there is delay on arrival of Webtrust Seals from our Auditor / CPA Canada due to the reasons expressed by Auditor in the attachment. Once these Webtrust Seals are made available, the latest reports will be updated via CPA Canada link in our Repository. In the interim, we are publishing the audit reports received from our auditor as part of attachments to this incident, and using those URLs to submit necessary Audit case in CCADB.

Comment 7

[Vijay Kumar]

As an update to this thread, we have received final Webtrust seals from CPA Canada. These have been updated in our Repository (https://repository.emsign.com/).

The direct links to Audit Statements are provided below:
WebTrust for CA: https://www.cpacanada.ca//GenericHandlers/CPACHandler.ashx?AttachmentID=265025
SSL Baseline: https://www.cpacanada.ca//GenericHandlers/CPACHandler.ashx?AttachmentID=265043
EV SSL: https://www.cpacanada.ca//GenericHandlers/CPACHandler.ashx?AttachmentID=265044
PTCS: https://www.cpacanada.ca//GenericHandlers/CPACHandler.ashx?AttachmentID=265045
EVCS: https://www.cpacanada.ca//GenericHandlers/CPACHandler.ashx?AttachmentID=265046

There was a delay by a week from the earlier assured third week of September due to some procedural matters at Auditor's end.

The latest Seal URLs have been taken up for necessary submission with Trust Stores including Mozilla.

We believe, this update should be able to formally close this incident thread. Please let us know. Thank you.

Comment 8

[Ben Wilson]

I've processed this in the CCADB and everything seems to be in order. I believe it can be closed and will do so on Friday, 1-Oct-2021.

Comment 9

[Ben Wilson]

One more thing - do you have a statement of auditor qualifications from BDO Malaysia that you can provide to us?

Comment 10

[Vijay Kumar]

Attachment: BDO - Auditor WTCA Qualification for emSign PKI.pdf

Comment 11

[Vijay Kumar]

Hi Ben,

We have received Auditor Qualification letter from BDO Malaysia. Same is attached to this thread.

Regards,
Vijay

Comment 12

[Ben Wilson]

CCADB updates completed 1-Dec-2021. Closing this matter.