← Entrust cases
Bugzilla #1667448
Certificate Problem Report
Entrust: Incorrect keyUsage for ECC certificate
RESOLVED
FIXED
Entrust
AI Summary
Entrust identified an issue where an ECC SSL certificate was incorrectly issued with a keyUsage value of keyEncipherment, contrary to RFC 5480 requirements. The problem was discovered on September 25, 2020, during a compliance check using post-issuance linting software. Following the discovery, the affected certificate was revoked, and an investigation was initiated to determine the cause. The root of the issue was traced back to a bug in the enrollment software that allowed an ECC key request to be processed by a CA configured for RSA keys. Entrust has since updated its linting software to prevent future occurrences.
Chronology
- Entrust compliance team discovered the incorrect keyUsage during a routine check.
- Certificate with incorrect keyUsage was issued and subsequently revoked.
- Entrust updated its pre-issuance linting software to prevent future misissuance.
Participants
Bruce Morton
Ryan Sleevi
External References
Similar Local Cases
Entrust: SSL Certificates issued with Un-verified IP Addresses
Entrust: IP Address in dNSName form
Entrust: Printable String Constraint Failure
Entrust: Certificate issued with '-' in ST field
Entrust: S/MIME Certificate Issued with Incorrect Policy OID
Entrust: Failure to revoke a certificate
Entrust: Late revocation of underscore certificate
Entrust: Late Revocation for SSL Certificates issued with Un-verified IP Addresses