Entrust: Failure to revoke a certificate
This case concerns Entrust Datacard compliance discovering that an SSL certificate was issued with quotation marks in the printable string format in the Organization field of the Subject DN, which caused OCSP rejection and prevented an OCSP status from being provided. Entrust stated that the OCSP software rejected the certificate due to the ASN.1 constraint failure, so the certificate was effectively not revoked via OCSP within the Baseline Requirements timeframe. Entrust reported that the certificate was revoked on CRL on 1 May 2020 (within 5 days per CRL) and that an OCSP patch was implemented on 28 May 2020, after which the certificate was revoked on OCSP. Entrust also stated that it migrated the subordinate CA to newer OCSP/CA software on 9 June 2020 to resolve the printable string bug and prevent similar issuance. In response to Mozilla’s question about delayed revocation, Entrust explained that the OCSP system initially rejected the certificate and would not allow a certificate serial number to be uploaded to avoid false status, and that the OCSP system was later upgraded to allow rejected certificates to be uploaded as revoked. The bug is marked RESOLVED with resolution FIXED.
- An SSL certificate was issued with quotation marks in the Organization field printable string format, causing OCSP rejection.
- The certificate was revoked on CRL.
- An OCSP software patch was implemented and the certificate was revoked on OCSP.
- The subordinate CA was migrated to newer software that resolved the printable string bug.
- Community commenter — Reported that Entrust confirmed it would not be capable of indicating the certificate is revoked via OCSP within the Baseline Requirements time, and noted OCSP responses were unauthorized.
- Entrust representative — Provided a detailed response describing discovery of the issue, issuance/OCSP failure timeline, CRL revocation, OCSP patching, and planned mitigation via CA/OCSP software upgrades and pre-issuance linting.
- Mozilla representative — Asked Bruce to include the timeline portion of the response.
- Entrust representative — Stated the subordinate CA was migrated to new software on 9 June 2020, resolving the printable string bug.
- Mozilla representative — Asked for more explanation of the delayed revocation cause and future steps to ensure timely revocation.
- Entrust representative — Explained the certificate was revoked within 5 days on CRL, but OCSP initially rejected it and would not allow serial upload until patched/upgraded to allow rejected certificates to be uploaded as revoked.
- Mozilla representative — Indicated intent to close the bug on or after 7-August 2020 unless there were additional questions.