← TrustCor Systems cases
Bugzilla #1599571
Certificate Problem Report
TrustCor: Non-revocation of CA certificates within 7 days
RESOLVED
FIXED
TrustCor Systems
AI Summary
TrustCor Systems faced a compliance issue regarding the non-revocation of two Subordinate CA certificates within the required 7-day timeframe after discovering discrepancies in their audit reports. The delay was attributed to the potential business disruption for customers, as no SSL certificates had been issued under the S/MIME CA certificates. TrustCor has since revoked the Enhanced Secure Email CA certificate and outlined a plan for the Basic Secure Email CA certificate's revocation, which was completed on April 1, 2020. The company is also implementing changes to its certificate hierarchy to prevent future delays.
Chronology
- TrustCor alerted to discrepancies in audit reports.
- Self audit completed confirming no SSL certificates issued under S/MIME CA.
- Enhanced Secure Email CA Certificate formally revoked.
- Basic Secure Email CA Certificate formally revoked.
Participants
Neil Dunbar
Ryan Sleevi
Kathleen Wilson
Wayne Thayer
External References
Similar Local Cases
TrustCor: No mention of TLS-capable Intermediate CAs in WTBR audit reports
TrustCor: Insufficient Serial Number Entropy
TrustCor: Non-audited intermediate certificates
Microsoft PKI Services: Null Character Bug and Microsoft Root CAs
Consorci AOC: Non-BR-Compliant Certificate Issuance
DocuSign/Keynectis: Non-BR-Compliant OCSP Responders
Asseco DS / Certum: Failure to revoke intermediate certificates within the BR time period
GlobalSign: Failure to revoke 2 noncompliant QWACs within 5 days