A rated company raised an issue with how Bitsight grades certain certificates. Established best practices dictate that internet-facing assets that serve leaf certificates must also provide intermediate and root certificates to prove their authenticity to the client. Bitsight performs trust anchor validation and negatively grades certificates that are either self-signed or fail to include the other certificates in their chain of trust, even if a client may be able to complete the chain with their own cached certificates. Some TLS/SSL services, however, require a response with a client certificate issued in advance or the server will terminate the connection with a TLS error and prohibit access to the application layer (e.g., a website); these services may be self-signed or otherwise fail the trust anchor validation process.
The Policy Review Board concluded that Bitsight should change policy when possible to exclude certificate chain validation for systems that require client certificate authentication, as the PRB considers it a reasonable mitigation to the risks posed by having self-administered trust anchors.