IdenTrust: Failure to disclose Unconstrained intermediate within 7 days

IdenTrust reported that it failed to disclose an Intermediate CA certificate to CCADB within one week of certificate creation, as required by Section 5.3.2 of the Mozilla Policy. The issue was identified after Mozilla prompted IdenTrust, and IdenTrust stated that it realized it had not disclosed an Intermediate CA certificate issued on 2/28/19 within the required timeframe. IdenTrust explained that its disclosure procedures were triggered by actual issuance of end-entity certificates rather than also within 7 days of intermediate certificate generation. IdenTrust also described that an attempted replacement disclosure on 3/27/19 caused de-listing of the original intermediate certificate, which led it to recognize that both intermediate certificates needed to be listed as separate CCADB records. As remediation, IdenTrust stated it had disclosed to CCADB all intermediate certificates within scope of Mozilla Policy section 1.1 and said it would include CCADB disclosure in upfront planning with a target disclosure date set prior to intermediate generation, enforced by procedural controls. The bug was marked RESOLVED with resolution FIXED, and a later comment indicated remediation was complete.

1. 2018-10-12 IdenTrust created an Intermediate CA certificate (original intermediate).
2. 2018-10-16 IdenTrust disclosed the original Intermediate CA certificate to CCADB.
3. 2019-02-28 IdenTrust created a replacement Intermediate CA certificate.
4. 2019-03-27 IdenTrust disclosed the replacement Intermediate CA certificate to CCADB, which de-listed the original intermediate record.
5. 2019-03-28 IdenTrust, prompted by Mozilla, realized it had not disclosed the intermediate within one week of creation as required.
6. 2019-04-04 IdenTrust submitted the incident report describing the disclosure failure and remediation steps.
7. 2019-08-11 A comment stated that remediation appeared complete.

1. 2019-04-04 IdenTrust Services, LLC — IdenTrust reported that it realized it had not disclosed an Intermediate CA certificate within one week of creation, explained how its procedures triggered disclosure, and described remediation steps including upfront planning and procedural controls for CCADB disclosure timing.
2. 2019-04-30 Mozilla representative — A bot comment noted the priority flag was not set and asked :kwilson to look.
3. 2019-04-30 Mozilla representative — A bot comment corrected the bug type to task.
4. 2019-08-11 Fastly representative — The commenter stated it appeared that all questions had been answered and remediation was complete.