IdenTrust: Internal names / failure to report
The case concerns an Identrust TLS certificate that contained SAN entries for invalid “.int” domains. Nicholas Hatch reported the misissuance during discussion of an inclusion request in bug 1339292, and Identrust acknowledged the issue and revoked the certificate in a timely manner. Identrust stated that it became aware of the problem on 02/22/2018 via an email message to its customer support from Nicholas Hatch, and that the certificate was revoked on the same date. Identrust reported that only one certificate was found with a SAN containing “.int”, and that it was issued on 5/21/2015 and revoked on 2/22/2018. Identrust explained that the certificate was generated for an internal server and that the “.int” SAN entries were internal domains at the time; after identification, Identrust revoked the certificate and issued a new one without the “Autodiscover.identrus.int” and “Mercury.identrus.int” entries. Identrust also stated that it implemented a change in its certificate approval processes after 02/22/2018 to prevent “.int” domain names from being approved. The bug was resolved as FIXED, and the discussion was noted to have resulted in denial of an EV request in bug 1339292.
- A misissued certificate containing SAN entries for invalid .int domains was reported to Identrust.
- IdenTrust revoked the certificate and reported remediation steps, including process changes to prevent .int SAN entries.
- Thread noted that the discussion resulted in denial of an EV request in bug 1339292.
- Fastly representative — Wayne Thayer described the reported misissuance and stated that Identrust acknowledged and revoked the certificate, but he questioned whether Identrust disclosed the misissuance as required; Identrust provided an incident report with awareness date, revocation date, certificate list, explanation, and remediation/process changes.
- Fastly representative — Wayne Thayer noted that the discussion resulted in denial of the EV request in bug 1339292.