Information for Auditors and Assessors

To increase trust in the application of PKI technology, the CA/Browser Forum has mandated that a CA, in order to issue Publicly-Trusted Certificates, obtain an audit report under a qualified audit scheme performed by a qualified auditor.

In order to issue SSL certificates, most CAs will need to complete an approved independent third-party audit. There are three alternatives. The first is an audit against WebTrust for Certification Authorities criteria, issued by the WebTrust for Certification Authorities Task Force-a joint task force of the American Institute of Certified Public Accountants and the Chartered Professional Accountants of Canada (CPA Canada). Specifically, WebTrust for Certification Authorities and WebTrust for Certification Authorities – SSL Baseline Requirements Audit Criteria have been developed to meet the CA/Browser Forums Baseline SSL Requirements.

Another alternative for an independent third-party audit is an audit that conforms to ETSI EN 319 411-1 or ETSI EN 319 411-2. These standards are published by the European Telecommunications Standards Institute (ETSI).

Also available, but rarely used is an audit that conforms to ISO 21188:2006.

In addition, recognizing the importance of an independent third party audit of the controls, processes and procedures of CAs, the CA/Browser Forum’s EV Guidelines include a specific audit requirement for CAs that wish to issue EV certificates.

A non-governmental CA issuing EV Certificates needs to undergo an audit in accordance either the WebTrust for Certification Authorities audit and the WebTrust EV Program audit, or the ETSI EN 319 411-1 audit.