2074032 - PKIoverheid: TSP KPN Delayed publication of audit attestation letters in the CCADB

Status: ASSIGNED

(CA Program :: CA Certificate Compliance, task)

Description

[Policy Authority PKIoverheid]

Preliminary Incident Report

Summary

• Incident description: Logius did not upload the required Audit Attestation Letter(s) to the CCADB for subCAs "KPN PKIoverheid Organisatie Persoon CA - G3" and "KPN PKIoverheid Organisaties Services CA - G3" within the CCADB Policy deadline of 92 calendar days after the end date of the audit period. The 92-day deadline expired on 2026-08-31, and the Audit Attestation Letter(s) were uploaded to the CCADB on 2026-09-10 (initial) and again on 2026-09-15 (fix for ETSI standards version number).
• Relevant policies:
• CCADB Policy v2.1 (effective 2026-03-20), Section 5.2 “Audit Statement Content”
• Mozilla Root Store Policy v3.1 (effective 2026-07-01), Section 3.1.3 “Audit Parameters” and
• Audit Requirements - Microsoft Trusted Root Certificate Program, Section D. “The Time Period Between the Assessment and the Auditor's Attestation"
• Source of incident disclosure:: Self-reported