WebTrust for CAs (WebTrust audit)

WebTrust for CAs is a family of audit criteria, administered by CPA Canada, used to assess certificate authorities. Separate criteria cover general CA operations, the TLS Baseline Requirements together with network security, Extended Validation, S/MIME and code signing. Licensed practitioners issue period-of-time reports, normally covering a year, which CAs submit to root programs through the CCADB. The main alternative is an ETSI audit (EN 319 411) performed by a conformity assessment body, common among European CAs.

Why it matters

Root programs cannot inspect every CA themselves, so they require an unbroken sequence of annual audits. A gap, a late report or a qualified opinion listing failures can lead to restrictions or distrust. For certificate buyers, a CA's current audit reports are among the few objective signals of its operational discipline. Audit findings are, however, an input to root program decisions rather than the decision itself.

Example

A typical cycle looks like this:

Audit period:   12 months of CA operations
Report:         auditor's opinion on whether controls operated effectively,
                listing any exceptions found
Disclosure:     CA uploads the report to the CCADB
Review:         root programs read it alongside the CA's incident reports

Common misconceptions

• A WebTrust seal means a website is safe. The audit concerns the CA's operations, not the sites that use its certificates.
• Passing the audit means the CA had no problems. Reports can be qualified and list exceptions, and root programs also weigh incidents outside the audit.
• WebTrust is the only accepted audit. ETSI-based audits are also accepted by the major root programs.