CA/Visa Issues: Difference between revisions

Visa received an initial point-in-time Baseline Requirements audit on March 31, 2016 [https://bugzilla.mozilla.org/attachment.cgi?id=8795503 [1]]. This was more than two years past Mozilla’s deadline for BR compliance: “CAs with a root certificate that has the websites (SSL/TLS) trust bit enabled in Mozilla's CA Certificate Program shall have their SSL certificate issuance and operations audited according to the Baseline Requirements between February 15, 2013, and February 15, 2014.” [https://wiki.mozilla.org/CA:CertificatePolicyV2.1#Time_Frames_for_included_CAs_to_comply_with_the_new_policy [2]]

Visa has yet to receive a clean (unqualified) BR audit. Their first point-in-time audit conducted by KPMG lists 7 qualifications [https://bugzilla.mozilla.org/attachment.cgi?id=8795503 [1]]. Their 2017 BR audit [https://bug1301210.bmoattachments.org/attachment.cgi?id=9004729 [3]] conducted by BDO lists 3 qualifications, and their standard 2017 WebTrust audit [https://bug1301210.bmoattachments.org/attachment.cgi?id=9004730 [4]] lists one qualification. We recently received Visa’s 2018 audits containing a total of 5 qualifications [https://bugzilla.mozilla.org/show_bug.cgi?id=1485777 [5]].

'''WebTrust for CAs'''

'''WebTrust Baseline Requirements'''

The point-in-time audit states that “Verification of the Fully-Qualified Domain Name(s) and IP address(es) listed in the certificates is not formally performed and documented per Baseline Requirements.” Visa responded that the issue had been remediated, but the 2017 audit states that “We were unable to obtain evidence of the domain validation documentation for a certificate issued.” (one specific certificate was identified as lacking documentation). Visa responded with the following statement:

Visa’s original BR point-in-time audit describes the following deficiency:

"Visa has a detailed corporate onboarding process for new clients who may ultimately require publicly trusted SSL certificates to do business with VISA. However, it was noted that the VISA CA’s vetting procedures do not specifically address the referenced WTBR criteria at the time of certificate issuance for verification of the O, OU, L, C attributes. It was also noted that the VISA CA uses an internal system (VISA Profiler) to verify client organization and individual information, but there is no process in place to validate that information by using a third-party database considered a Reliable Data Source or attestation letters."

In bug 1391087 [https://bugzilla.mozilla.org/show_bug.cgi?id=1391087 [13]], Visa was found to have issued two certificates [https://misissued.com/batch/8/ [14]] containing internal names that were not revoked by the BR deadline of October 1, 2016. In the bug, Visa stated that they completed their initial BR audit in September 2016 when the BR point-in-time audit report was issued, but one of these certificates was issued after the BR point-in-time audit date of March 31, 2016. In this bug, Visa declined repeated requests to provide a list of additional misissued certificates that were identified during their internal investigation.

==Issue L: 2018 Audit Report Delivered Late / Documents Ongoing Problems==

The WTCA qualification on criterion 6.6 indicates one of the issues from the prior year was still not fixed. Likewise, the WTBR audit indicates a failure to meet criterion 2-4.1 as was the case in the previous two audits. An incident bug was opened requesting that Visa describe how they plan to remediate the issues identified in this year’s reports [https://bugzilla.mozilla.org/show_bug.cgi?id=1485851 [20]]. As of September 4, Visa has only replied that “We are preparing a detailed response and we will respond shortly”.