Audit Attestation Letter for EVROTRUST TECHNOLOGIES JSC

Transcription

1 Conformity Assessment Body eidas Trust Service Providers ISO LA ISO LI ISO RM ISO Audit Attestation Letter for EVROTRUST TECHNOLOGIES JSC Reference: No AL-V3.0 Saint-Malo, the 9 th March 2018 To whom it may concern, This is to confirm that LSTI has successfully audited the CAs of the EVROTRUST TECHNOLOGIES JSC without critical findings. This present Audit Attestation Letter is registered under the unique identifier number n AL-V3.0 and consists of 6 pages. Kindly find here-below the details accordingly. In case of any question, please contact: LSTI Group 10 Avenue Anita Conti Saint-Malo, France atrotin@lsti.eu Phone: With best regards, Armelle Trotin Head of Certification Body LSTI WORLDWIDE Limited A LSTI Group member Suite B, Apex centre SANDYFORD Business Park DUBLIN 18 IRELAND LSTI SAS 10 Avenue Anita Conti SAINT-MALO FRANCE LSTI East Europe A LSTI Group member Office #, ét.2, entr. 3 bl. 418, Mladost SOFIA République de Bulgarie

2 Audit Attestation Technologies JSC AL-V3.0 Identification of the conformity assessment body (CAB): LSTI 1,10 Avenue Anita Conti, Saint-Malo, France registered under n Accredited by COFRAC under registration number in accordance with EN ISO/IEC 17065:2013 and in accordance with the eidas EU Regulation art. 3 (18) and the ETSI 403 v Detailed scope at Identification of the trust service provider (TSP): EVROTRUST TECHNOLOGIES JSC 101 Tsarigradsko shosse Blvd., ACTIVE Business Center, floor 6, 1113 Sofia, REPUBLIC OF BULGARIA registered under n BG Identification of the audited Root- CA: Root CA Distinguished Name SHA-256 fingerprint Serial number Applied policy RSA Root CA B4:9C:F6:52:B7:2E:58:64:98:DB:42:CD:00:75:00:91 2F:D1:67:2A:FC:3D:FF:0B:11:B9:27:EA:97:D4:1A:2D 6c 6e c9 bf a5 4b d4 0f policy of ETSI QCP-w of ETSI Identification of the audited Root- CA: SubCA Distinguished Name SHA-256 fingerprint Serial number Applied policy RSA Operational CA 6B:2A:9F:D5:17:A7:8A:F2:A6:21:85:F3:34:57:76:4F C9:1E:BE:E8:4A:55:F6:3F:18:62:78:DC:FD:E6:8A:75 38:00:00:00:03:4E:8E:CB:48:09:25:01:BC: 00:00:00:00:00:03 policy of ETSI QCP-w of ETSI in the following termed shortly CAB This template (version 2 as of ) was approved for use by ACAB-c. It may only be used to without modification. page 2 of 6 pages

3 Audit Attestation Technologies JSC AL-V3.0 The audit was performed as full annual audit at the TSP s location in Sofia, Republic of Bulgaria. It took place from 26/05/2017 until 30/05/2017 and covered the period from 26/05/2016 until 26/05/2017. The audit was performed according to the European Standards ETSI 411-2, V2.1.1 ( ), ETSI 411-1, V1.1.1 ( ) and ETSI 401, V2.1.1 ( ) as well as CA Browser Forum Requirements EV SSL Guidelines, version and Baseline Requirements, version considering the requirements of the ETSI 403, V2.2.2 ( ) for the Trust Service Provider Conformity Assessment. And Certification scheme: LSTI-Q055-V5.2: Certification rules for Trust Service providers. The full annual audit was based on the following policy and practice statement documents of the TSP: 1. [CPS] Certification Practice Statement for Qualified Certification Services - Version /04/ [CP] Policy for Qualified Certification Services for Advanced Electronic Signature/Seal - Version /04/ [CP] Policy for Qualified Certification Services for Qualified Electronic Signature/Seal - Version /04/ [CP] Policy for Qualified Certification Services for Authentication - Version /04/ [CP] Qualified Validation Policy - Version /04/ [TSA CPS/CP] Timestamp Certification Authority Policy - Version /04/ [PKIDS] PKI Disclosure Statement - Version /04/ [GTC] General Terms and Conditions for Certification, Information, Cryptographic and Consultancy Services - Version /04/ [SA] Contract for Use of Services Accessible Through the Application of Technologies Jsc - Version /04/ [SA] Signatory Agreement - Version /04/2017 The Sub-CAs that have been issued by the aforementioned Root-CA and that have been covered by this audit are listed in table 1 below. The TSP assured that all non-revoked Sub-CA s that are technically capable of issuing server or certificates and that have been issued by this Root-CA are in the scope of regular audits. This template (version 2 as of ) was approved for use by ACAB-c. It may only be used to without modification. page 3 of 6 pages

4 Audit Attestation Technologies JSC AL-V3.0 Identification of the Sub-CA Distinguished Name SHA-256 fingerprint Serial number Applied policy OID Service EKU Validity RSA Root CA RSA Root CA B4:9C:F6:52:B7:2E:58:64: 98:DB:42:CD:00:75:00:912 F:D1:67:2A:FC:3D:FF:0B:1 1:B9:27:EA:97:D4:1A:2D 6c 6e c9 bf a5 4b d4 0f Root CA Root 20/5/ /5/2036 RSA Operational CA RSA Operational CA 6B:2A:9F:D5:17:A7:8A:F2: A6:21:85:F3:34:57:76:4FC 9:1E:BE:E8:4A:55:F6:3F:1 8:62:78:DC:FD:E6:8A:75 38:00:00:00:03:4E:8E:C B:48:09:25:01:BC:00:0 0:00:00:00:03 sub CA Code Signing Secure Time Stamping OCSP Signing 21/5/ /5/2026 for QES for QES QCP-n-qscd Signature Attribute for QES Attribute for QES QCP-n-qscd Signature for QESeal for QESeal QCP-l Seal This template (version 2 as of ) was approved for use by ACAB-c. It may only be used to without modification. page 4 of 6 pages

5 Audit Attestation Technologies JSC AL-V3.0 for AES for AES QCP-n-qscd Signature for AESeal for AESeal QCP-l Seal TSA TSA TSAP Time Stamp Time-stamping SSL Domain Validated SSL Domain Validated DVCP SSL Organization Validated SSL Organization Validated OVCP Server Server QCP-w SSL EV * SSL EV EVCP Table 1: Sub-CA s issued by the Root-CA * EV insurance policy period from to This template (version 2 as of ) was approved for use by ACAB-c. It may only be used to without modification. page 5 of 6 pages

6 Audit Attestation Technologies JSC AL-V3.0 Modifications records Version Issuing Date Changes Version 3 9 March 2018 Change of template End of the audit attestation letter This template (version 2 as of ) was approved for use by ACAB-c. It may only be used to without modification. page 6 of 6 pages