Auditor Compliance

CA Audits play a crucial role in the Web PKI. The WebTrust and ETSI CA audit standards provide criteria and auditor guidance aimed at delivering consistent audit results. But much is still up to the subject matter expertise, diligence, and trustworthiness of the individuals performing the audit, and of the local office of the audit firm that is performing the audit.

Auditors are not themselves audited in a public way that allows for a relatively easy assessment of their performance. As is often the case with CAs, individual issues in which an auditor failed to identify or report a problem can become significant when a pattern develops over time. In order to better track these patterns of concerning auditor actions, Mozilla has begun to create auditor compliance bugs when issues are discovered.

Mozilla does not currently have an “Auditor Policy” that places certain Mozilla-specific requirements on auditors that we accept. Auditors are encouraged but not required to create Bugzilla accounts and respond to their compliance bugs, and to participate in relevant discussions in the MDSP mailing list. Mozilla recognizes the unfortunate fact that some audit firms strictly control their employees’ participation in public forums. Unlike CA compliance bugs, auditor compliance bugs may be closed without ever receiving a public response from the auditor.

Disqualified Auditors

Mozilla reserves the right to refuse audits from otherwise qualified auditors - either entire audit firms or specific offices/regions. Mozilla currently refuses audits from:

• Ernst & Young Hong Kong - this was part of the Wosign remediation plan.

Open Auditor Compliance Bugs

An auditor compliance bug relates to a concern about an auditor failing to properly detect and report on CA compliance issues that occurred during one or more periods when the CA was audited.

Anyone may create an auditor compliance bug as follows:

• https://bugzilla.mozilla.org/enter_bug.cgi?product=CA%20Program&component=CA%20Certificate%20Compliance
• Whiteboard = [auditor-compliance]

No results.

0 Total; 0 Open (0%); 0 Resolved (0%); 0 Verified (0%);

Closed Auditor Compliance Bugs

11 Total; 0 Open (0%); 11 Resolved (100%); 0 Verified (0%);