Entrust: Compromised Private Key Revoked 8h 52m After 24-Hour Deadline

Entrust Datacard reported that it received third-party notifications about a customer private key exposure on January 20, 2020. Entrust stated that BR 4.9.1.1 required revocation within 24 hours of key compromise, but due to a process error it used the later notification time (3:31 pm UTC) as the incident report time. As a result, the certificate was revoked 8 hours and 52 minutes past the 24-hour deadline, with the official revocation time recorded as 3:21 pm UTC on January 21, 2020. Entrust described that the first notification (6:39 am UTC) was not escalated to management because the case created from that email was mislabeled and never escalated according to its process. To remediate, Entrust said it would add measures including tagging support cases under the compliance category and implementing email content scanning for keywords indicating compliance issues, with automated notification to a compliance management distribution list. Entrust later confirmed that the content scanning and tagging enhancements were implemented, and a participant stated that remediation was complete. The bug is marked RESOLVED with resolution FIXED.

1. 2020-01-20 Entrust received third-party notifications that a customer private key was exposed and initiated its revocation response.
2. 2020-01-21 Entrust’s customer certificate was revoked at 3:21 pm UTC, after missing the 24-hour deadline.
3. 2020-02-06 Entrust confirmed implementation of remediation measures for compliance case tagging and automated escalation.

1. 2020-01-23 Entrustdatacard representative — Entrust explained that it revoked the certificate 8 hours 52 minutes after the 24-hour deadline due to using the wrong incident report time and failing to escalate the first notification.
2. 2020-01-25 Community commenter — Ryan asked Dathan to clarify how the report was received (which email path) and how it related to the CPS reporting contacts.
3. 2020-01-25 Filippo representative — Filippo stated he believed he was the first third party mentioned and shared additional details about his notification and the reply he received.
4. 2020-01-27 Entrustdatacard representative — Dathan confirmed Filippo used the correct CPS contact and described planned remediation: compliance tagging and automated notifications, plus keyword-based email content scanning.
5. 2020-01-31 Entrustdatacard representative — Dathan reported that item 2 (content scanning) was still being worked on and would be updated by Feb 7.
6. 2020-01-31 Community commenter — Ryan commented that the approach still seemed to rely on content scanning/human categorization and asked whether a simpler compliance-dedicated escalation path could be used.
7. 2020-02-06 Entrustdatacard representative — Dathan explained the CPS contact email is used for technical support as well, and confirmed the content scanning and tagging enhancements were implemented.
8. 2020-02-07 Fastly representative — Wthayer stated it appears all questions were answered and remediation is complete.