{"bugs":{"2055439":{"comments":[{"count":0,"creator":"clopez@firmaprofesional.com","id":18202762,"reactions":{},"raw_text":"## 2026 audit-delay explanatory letter\n\nThis bug provides the Qualified Auditor's signed explanatory letter concerning the delayed issuance and publication of the 2026 Audit Attestation Letters for Autoridad de Certificacion Firmaprofesional.\n\n- **CA Owner:** Autoridad de Certificacion Firmaprofesional\n- **Conformity Assessment Body:** DEKRA Testing and Certification, S.A.U.\n- **Audit period:** 2025-03-28 through 2026-03-27\n- **Affected AAL types:** Standard, TLS Baseline Requirements, and TLS Extended Validation Guidelines\n- **CCADB submission deadline:** 2026-06-27\n- **AAL statement date:** 2026-07-15\n- **CCADB case:** [Case 00003334](https://ccadb.my.site.com/s/case/500TO00000pjNr8YAE/2026-audit-for-firmaprofesional)\n\nThe signed explanatory letter is attached to this bug.\n\nFinal Audit Attestation Letters:\n\n- [Standard AAL](https://www.dekra-checkme.com/api/asset/product/document/download/T4O-2611_FPR_FR_GN-48175/cab-forum_aal_template_standard_audit_e_v3.5_2611_fpr%201-jer.pdf)\n- [TLS BR AAL](https://www.dekra-checkme.com/api/asset/product/document/download/T4O-2611_FPR_FR_BR-48177/cab-forum_aal_template_tls-br_audit_e_v3.5_2611_fpr%201-jer.pdf)\n- [TLS EV AAL](https://www.dekra-checkme.com/api/asset/product/document/download/T4O-2611_FPR_FR_EV-48176/cab-forum_aal_template_tls-ev_audit_e_v3.5_2611_fpr%201-jer.pdf)","is_private":false,"text":"Created attachment 9609478\nSigned explanatory letter from the Qualified Auditor concerning the delayed 2026 AALs\n\n## 2026 audit-delay explanatory letter\n\nThis bug provides the Qualified Auditor's signed explanatory letter concerning the delayed issuance and publication of the 2026 Audit Attestation Letters for Autoridad de Certificacion Firmaprofesional.\n\n- **CA Owner:** Autoridad de Certificacion Firmaprofesional\n- **Conformity Assessment Body:** DEKRA Testing and Certification, S.A.U.\n- **Audit period:** 2025-03-28 through 2026-03-27\n- **Affected AAL types:** Standard, TLS Baseline Requirements, and TLS Extended Validation Guidelines\n- **CCADB submission deadline:** 2026-06-27\n- **AAL statement date:** 2026-07-15\n- **CCADB case:** [Case 00003334](https://ccadb.my.site.com/s/case/500TO00000pjNr8YAE/2026-audit-for-firmaprofesional)\n\nThe signed explanatory letter is attached to this bug.\n\nFinal Audit Attestation Letters:\n\n- [Standard AAL](https://www.dekra-checkme.com/api/asset/product/document/download/T4O-2611_FPR_FR_GN-48175/cab-forum_aal_template_standard_audit_e_v3.5_2611_fpr%201-jer.pdf)\n- [TLS BR AAL](https://www.dekra-checkme.com/api/asset/product/document/download/T4O-2611_FPR_FR_BR-48177/cab-forum_aal_template_tls-br_audit_e_v3.5_2611_fpr%201-jer.pdf)\n- [TLS EV AAL](https://www.dekra-checkme.com/api/asset/product/document/download/T4O-2611_FPR_FR_EV-48176/cab-forum_aal_template_tls-ev_audit_e_v3.5_2611_fpr%201-jer.pdf)","attachment_id":9609478,"author":"clopez@firmaprofesional.com","bug_id":2055439,"collapsed":false,"tags":[],"creation_time":"2026-07-16T10:45:15Z","time":"2026-07-16T10:45:15Z"},{"attachment_id":null,"author":"clopez@firmaprofesional.com","is_private":false,"text":"Related compliance incident: https://bugzilla.mozilla.org/show_bug.cgi?id=2055444","creator":"clopez@firmaprofesional.com","id":18202783,"reactions":{},"raw_text":"Related compliance incident: https://bugzilla.mozilla.org/show_bug.cgi?id=2055444","count":1,"tags":[],"collapsed":false,"creation_time":"2026-07-16T11:07:21Z","time":"2026-07-16T11:07:21Z","bug_id":2055439},{"time":"2026-07-23T07:25:59Z","collapsed":false,"tags":[],"creation_time":"2026-07-23T07:25:59Z","bug_id":2055439,"author":"clopez@firmaprofesional.com","attachment_id":null,"text":"## Status Update\n\nOur investigation and preparation of the Full Incident Report remain in progress.\n\nSince publication of the Preliminary Incident Report, we have continued reviewing the complete incident timeline, the public availability of the three final Audit Attestation Letters, the state of CCADB Case `00003334`, the Root Cause Analysis, and the remediation plan. An authenticated review of the CCADB case on `2026-07-23` confirmed that it remains in `Verification By Root Store`. The Standard, TLS Baseline Requirements, and TLS Extended Validation Guidelines sections each contain a public DEKRA AAL link, an audit period from `2025-03-28` through `2026-03-27`, a statement date of `2026-07-15`, and three selected applicable root certificates. Each displayed ALV status is `FAIL`; the displayed results identify `DateVerified=Fail` and `StatementDate=Fail`, and the authenticity-confirmed field is not selected. We therefore do not consider CCADB verification final. The Qualified Auditor's signed explanatory letter also remains publicly available as a non-obsolete attachment to [Bug 2055439](https://bugzilla.mozilla.org/show_bug.cgi?id=2055439).\n\nAt this time, there is no change to the known impact described in the Preliminary Incident Report: the delayed public availability of the Standard, TLS BR, and TLS EV audit disclosures for the audit period ending `2026-03-27`. The final scope and supporting evidence remain under validation, and the incident remains open.\n\nWe will publish the Full Incident Report no later than `2026-07-30 11:05:52 UTC`, or earlier if the remaining investigation and review are completed sooner. We will report any material change before that time.\n\nWe request that the Bugzilla Whiteboard `Next update` field be set to `2026-07-30`.","is_private":false,"id":18216211,"raw_text":"## Status Update\n\nOur investigation and preparation of the Full Incident Report remain in progress.\n\nSince publication of the Preliminary Incident Report, we have continued reviewing the complete incident timeline, the public availability of the three final Audit Attestation Letters, the state of CCADB Case `00003334`, the Root Cause Analysis, and the remediation plan. An authenticated review of the CCADB case on `2026-07-23` confirmed that it remains in `Verification By Root Store`. The Standard, TLS Baseline Requirements, and TLS Extended Validation Guidelines sections each contain a public DEKRA AAL link, an audit period from `2025-03-28` through `2026-03-27`, a statement date of `2026-07-15`, and three selected applicable root certificates. Each displayed ALV status is `FAIL`; the displayed results identify `DateVerified=Fail` and `StatementDate=Fail`, and the authenticity-confirmed field is not selected. We therefore do not consider CCADB verification final. The Qualified Auditor's signed explanatory letter also remains publicly available as a non-obsolete attachment to [Bug 2055439](https://bugzilla.mozilla.org/show_bug.cgi?id=2055439).\n\nAt this time, there is no change to the known impact described in the Preliminary Incident Report: the delayed public availability of the Standard, TLS BR, and TLS EV audit disclosures for the audit period ending `2026-03-27`. The final scope and supporting evidence remain under validation, and the incident remains open.\n\nWe will publish the Full Incident Report no later than `2026-07-30 11:05:52 UTC`, or earlier if the remaining investigation and review are completed sooner. We will report any material change before that time.\n\nWe request that the Bugzilla Whiteboard `Next update` field be set to `2026-07-30`.","reactions":{},"creator":"clopez@firmaprofesional.com","count":2},{"count":3,"creator":"clopez@firmaprofesional.com","id":18216223,"reactions":{},"raw_text":"Ticket https://bugzilla.mozilla.org/show_bug.cgi?id=2055444 updated","is_private":false,"text":"Ticket https://bugzilla.mozilla.org/show_bug.cgi?id=2055444 updated","attachment_id":null,"author":"clopez@firmaprofesional.com","bug_id":2055439,"collapsed":false,"tags":[],"creation_time":"2026-07-23T07:33:12Z","time":"2026-07-23T07:33:12Z"},{"creator":"clopez@firmaprofesional.com","reactions":{},"raw_text":"## Closure Request\n\nThe purpose of this `CA Documents` bug has been fulfilled. The [signed explanatory letter from the Qualified Auditor](https://bugzilla.mozilla.org/attachment.cgi?id=9609478) remains publicly available, and the related compliance incident and its follow-up are tracked in [Bug 2055444](https://bugzilla.mozilla.org/show_bug.cgi?id=2055444) and it is already closed\n\nThere are no remaining actions associated with this document record. We request that this bug be closed as `RESOLVED WORKSFORME`.","id":18330673,"count":4,"attachment_id":null,"author":"clopez@firmaprofesional.com","is_private":false,"text":"## Closure Request\n\nThe purpose of this `CA Documents` bug has been fulfilled. The [signed explanatory letter from the Qualified Auditor](https://bugzilla.mozilla.org/attachment.cgi?id=9609478) remains publicly available, and the related compliance incident and its follow-up are tracked in [Bug 2055444](https://bugzilla.mozilla.org/show_bug.cgi?id=2055444) and it is already closed\n\nThere are no remaining actions associated with this document record. We request that this bug be closed as `RESOLVED WORKSFORME`.","creation_time":"2026-09-10T09:23:23Z","collapsed":false,"tags":[],"time":"2026-09-10T09:23:23Z","bug_id":2055439}]}},"comments":{}}