May 2020 CA Communication

ITEM 1: Impact of COVID-19 Restrictions Mandated restrictions due to COVID-19 may result in CAs being unable to physically access private key material or get auditors onsite to perform audits of CA facilities. Mozilla has provided guidance about what a CA should do if they realize that their audits will be delayed, including filing a Bugzilla Bug with Whiteboard = [ca-compliance][audit-delay][covid-19]. Similarly, CA Compliance problems that are due to mandated restrictions regarding COVID-19, such as delayed revocations, should also be indicated in a Bugzilla Bug by appending the [covid-19] Whiteboard tag. Please monitor the mozilla.dev.security.policy forum for updates. As a reminder, Mozilla can add certificates to OneCRL even if the CA is unable to revoke the certificates themselves. You may request this by sending email to certificates@mozilla.org. If such action is needed for a security vulnerability then also send the email to security@mozilla.org as described in Mozilla’s process for security-related problems. While adding certificates to OneCRL enables quicker propagation of revocation information, it is only relevant to Mozilla's Root Store, and CAs will still need to file a delayed-revocation Incident Report via Bugzilla whenever they are unable to meet the revocation requirements as specified in the CA/Browser Forum Baseline Requirements (BRs).
ITEM 1 COMMENTS

CA Owner Response Response
AC Camerfirma, S.A. We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Actalis We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Amazon Trust Services We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Asseco Data Systems S.A. (previously Unizeto Certum) We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Atos We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Autoridad de Certificacion Firmaprofesional We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Buypass We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
China Financial Certification Authority (CFCA) We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Chunghwa Telecom We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Cybertrust Japan / JCSI We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
D-TRUST We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Deutsche Telekom Security GmbH We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Dhimyotis / Certigna We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
DigiCert We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla. Apple SubCA: Apple expects no COVID-19 delays with delivering audit statements to provide to Mozilla. We will provide the audit report links for CCADB to you and the audit reports will be posted to https://www.apple.com/certificateauthority/ and https://www.apple.com/ certificateauthority/public no later than 15-July-2020.
Disig, a.s. We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
E-Tugra We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Entrust We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
GlobalSign nv-sa We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla. Our annual WebTrust audit is currently ongoing and so far, based on work already performed and information from the auditor, we do not anticipate any delays in the delivery of the report. If there would be any indication we might have a delay because of COVID-19 we will inform Mozilla in line with https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay.
GoDaddy We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Google Trust Services LLC We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Government of Hong Kong (SAR), Hongkong Post, Certizen We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Government of Taiwan, Government Root Certification Authority (GRCA) We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Government of The Netherlands, PKIoverheid (Logius) We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Government of Turkey, Kamu Sertifikasyon Merkezi (Kamu SM) We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
HARICA We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
IdenTrust Services, LLC We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Internet Security Research Group We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Izenpe S.A. We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Krajowa Izba Rozliczeniowa S.A. (KIR) We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Microsec Ltd. We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
NETLOCK Kft. We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
OISTE We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
QuoVadis We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
SECOM Trust Systems CO., LTD. We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
SK ID Solutions AS We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla. Fortunately we managed to complete our regular audit just before COVID-19 pandemia escalated. Regarding processing revocation requests we are able to fullfill all the requirements and we don’t see any issues there.
SSL.com We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Sectigo We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla. Our access to our offline CAs has not been affected.  Our auditor has not given us any indication that COVID-19 restrictions could affect the timely delivery of our next audit reports.
SecureTrust We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Shanghai Electronic Certification Authority Co., Ltd. We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
SwissSign AG We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Taiwan-CA Inc. (TWCA) We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Telia Company We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla. Our auditors are able to use their local partners to do the physical visits. Shouldn't be delays.
TrustCor Systems We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
Trustis We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla. N/A
Web.com We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla. Our auditor has not given us any indication that COVID-19 restrictions could affect the timely delivery of our next audit reports.
certSIGN We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.
eMudhra Technologies Limited We have reviewed https://wiki.mozilla.org/CA/Audit_Statements#Audit_Delay and understand the action to take if we need to report issues to Mozilla.