2041368 - Certigna: Finding #1 ETSI Audit – Missing system configuration information in the CP/CPS

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[Josselin Allemandou]

Preliminary Incident Report

Summary

• Incident description: The CP/CPS do not specify the maximum interval between two checks of the system configuration. This information is included in our “configuration management procedure” but has not been specified in the CP/CPS as required by ETSI EN 319 401 standard.
• Relevant policies: - Relevant policies: ETSI EN 319 401 V3.1.1 (2024-06) [REQ-6.3-09X]
• Source of incident disclosure: ETSI Annual Audit

Comment 1

[Josselin Allemandou]

Full Incident Report

Findings with regard to ETSI EN 319 401:
6.3 Information security policy
Documentation regarding the maximum interval between two checks of the configuration of the systems shall be improved. [REQ-6.3-09X]

Summary

• CA Owner CCADB unique ID: A000011

• Incident description:
  The CP/CPS do not specify the maximum interval between two checks of the system configuration. This information is included in our “configuration management procedure” but has not been specified in the CP/CPS as required by ETSI EN 319 401 standard.

• Timeline summary:

  • Non-compliance start date: 2025-12-12
  • Non-compliance identified date: 2026-02-27
  • Non-compliance end date: 2026-04-01

• Relevant policies: ETSI EN 319 401 V3.1.1 (2024-06) [REQ-6.3-09X]

• Source of incident disclosure:
  23-1713 – CAB-Forum – Audit Attestation Letter Standard V3.0_Certigna
  23-1713 – CAB-Forum – Audit Attestation Letter TLS-EV V3_Certigna
  23-1713 – CAB-Forum – Audit Attestation Letter TLS-BR V3_Certigna
  23-1713 – CAB-Forum – Audit Attestation Letter SMIME-BR V3_Certigna
  23-1713 – CAB-Forum – Audit Attestation Letter CS-BR V3_Certigna

Impact

No impact identified on certificates.

• Total number of certificates: (N/A)
• Total number of "remaining valid" certificates: (N/A)
• Affected certificate types: (N/A)
• Incident heuristic: No certificates had been affected
• Was issuance stopped in response to this incident, and why or why not?: No, as no certificates had been affected.
• Analysis: (N/A)
• Additional considerations: (N/A)
   

Timeline

2025-12-12: Last version of the CP/CPS does not include explicitly this information.
2026-02-27: An auditor identifies that the CP/CPS do not specify the maximum interval between two checks of the system configuration.
2026-03-09: Raising awareness among the compliance team regarding controls and guidelines for the verification of information explicitly required in the CP/CPS.
2026-03-09: Revision of the CP/CPS to identify security practices that must be explicitly included in the CP/CPS.
2026-03-11: Revision and update of the CP/CPS to specify the maximum interval between two system configuration checks, in accordance with our configuration management procedure.
2025-03-16: Receipt of the audit report with validation of proposed actions to address deviations.
2026-04-01: Validation of deviation resolution by auditor after analysis of actions performed.

Related Incidents

N/A

Root Cause Analysis

Contributing Factor #1: This information is outlined in our configuration management procedure

• Description: In accordance with the guidelines of the ISO 27002 standard, our organization has developed a configuration management procedure that provides details on this subject, From the teams' perspective the information was clearly outlined in a document, but not specifically in the CP/CPS.
• Timeline:
  2025-12-12: The most recent review of the document in December 2025 did not identify this missing information.
  2026-02-27: An auditor identifies that the CP/CPS do not specify the maximum interval between two checks of the system configuration.
  2026-03-11: Revision and update of the CP/CPS to specify the maximum interval between two system configuration checks, in accordance with our configuration management procedure.
• Detection: The ETSI auditor identifies that the CP/CPS do not specify the maximum interval between two checks of the system configuration.
• Interaction with other factors: N/A
• Root Cause Analysis methodology used: 5-Whys

Lessons Learned

• What went well: The correction was implemented without any significant impact.
• What didn’t go well: The last review was not thorough enough to catch this omission.
• Where we got lucky: The absence of this information does not affect the certificates and operations.
• Additional: N/A

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Raising awareness among the compliance team regarding controls and guidelines for the verification of information explicitly required in the CP/CPS	Prevent	Root Cause # 1	Should reduce the occurrence of this type of non-compliance	2026-03-09	Complete
Revision of the CP/CPS to identify security practices that must be explicitly included in the CP/CPS	Detect	Root Cause # 1	Should reduce the occurrence of this type of non-compliance	2026-03-09	Complete
Revision and update of the CP/CPS to specify the maximum interval between two system configuration checks	Mitigate	Root Cause # 1	Clarification added to the CP/CPS	2026-03-11	Complete

Appendix

No certificates affected (N/A)

Comment 2

[Josselin Allemandou]

Report Closure Summary

• Incident description: The CP/CPS do not specify the maximum interval between two checks of the system configuration. This information is included in our “configuration management procedure” but has not been specified in the CP/CPS as required by ETSI EN 319 401 standard.
• Incident Root Cause(s): In accordance with the guidelines of the ISO 27002 standard, our organization has developed a configuration management procedure that provides details on this subject, From the teams' perspective the information was clearly outlined in a document, but not specifically in the CP/CPS.
• Remediation description: Raising awareness among the compliance team regarding controls and guidelines for the verification of information explicitly required in the CP/CPS. Revision of the CP/CPS to identify security practices that must be explicitly included in the CP/CPS. Revision and update of the CP/CPS to specify the maximum interval between two system configuration checks.
• Commitment summary: Improvement of awareness, controls and guidelines regarding the information explicitly required in documents by applicable requirements.

All Action Items disclosed in this report have been completed as described, and we request its closure.

Comment 3

[incident-reporting]

This is a final call for comments or questions on this Incident Report.

Otherwise, it will be closed on approximately 2026-06-02.

Comment 4

[Dean F. Reed]

The preliminary report was posted on 2026-05-21.

The timeline describes "Non-compliance identified date: 2026-02-27".

Is there a reason this ticket was not posted in accordance with the CCADB Guidelines? One should have been posted by 2026-03-02.

Comment 5

[Josselin Allemandou]

Thank you for your comment.

That's right. A new incident report has just been created to address this issue: https://bugzilla.mozilla.org/show_bug.cgi?id=2043140

Comment 6

[Dimitris Zacharopoulos]

(In reply to Josselin Allemandou from comment #2)

Report Closure Summary

• Incident description: The CP/CPS do not specify the maximum interval between two checks of the system configuration. This information is included in our “configuration management procedure” but has not been specified in the CP/CPS as required by ETSI EN 319 401 standard.
• Incident Root Cause(s): In accordance with the guidelines of the ISO 27002 standard, our organization has developed a configuration management procedure that provides details on this subject, From the teams' perspective the information was clearly outlined in a document, but not specifically in the CP/CPS.
• Remediation description: Raising awareness among the compliance team regarding controls and guidelines for the verification of information explicitly required in the CP/CPS. Revision of the CP/CPS to identify security practices that must be explicitly included in the CP/CPS. Revision and update of the CP/CPS to specify the maximum interval between two system configuration checks.
• Commitment summary: Improvement of awareness, controls and guidelines regarding the information explicitly required in documents by applicable requirements.

All Action Items disclosed in this report have been completed as described, and we request its closure.

I'm not sure if this is explicitly called out in the https://www.ccadb.org/cas/incident-report but it would make sense for a CA to wait a few days after submitting a Final Incident Report for the community to have time to review, before submitting a Report Closure Summary.

Comment 7

[Josselin Allemandou]

(In reply to Dimitris Zacharopoulos from comment #6)

(In reply to Josselin Allemandou from comment #2)

Report Closure Summary

• Incident description: The CP/CPS do not specify the maximum interval between two checks of the system configuration. This information is included in our “configuration management procedure” but has not been specified in the CP/CPS as required by ETSI EN 319 401 standard.
• Incident Root Cause(s): In accordance with the guidelines of the ISO 27002 standard, our organization has developed a configuration management procedure that provides details on this subject, From the teams' perspective the information was clearly outlined in a document, but not specifically in the CP/CPS.
• Remediation description: Raising awareness among the compliance team regarding controls and guidelines for the verification of information explicitly required in the CP/CPS. Revision of the CP/CPS to identify security practices that must be explicitly included in the CP/CPS. Revision and update of the CP/CPS to specify the maximum interval between two system configuration checks.
• Commitment summary: Improvement of awareness, controls and guidelines regarding the information explicitly required in documents by applicable requirements.

All Action Items disclosed in this report have been completed as described, and we request its closure.

I'm not sure if this is explicitly called out in the https://www.ccadb.org/cas/incident-report but it would make sense for a CA to wait a few days after submitting a Final Incident Report for the community to have time to review, before submitting a Report Closure Summary.

Thank you for your comment.
Indeed. All the action items had been completed and there had been no comments since the ticket was created, so we went ahead and created the Report Closure Summary . Following your advice, we will indeed wait a little longer before publishing the Report Closure Summary for our futur incident reports.