Entrust: Failure to provide a preliminary report within 24 hours

This case concerns Entrust’s failure to provide a preliminary report to the original reporter within 24 hours after receiving a certificate problem report. The reporter said they alerted Entrust on 26 September 2020 about a certificate containing an invalid stateOrProvinceName value (“North Sydney”) and that, after providing additional information, they had not received a preliminary response by about 32 hours later. Entrust acknowledged the miss, stating it received and confirmed the incident within a couple of hours but that its customer support team did not provide the preliminary report details directly to the reporter, contrary to BR 4.9.5. Entrust investigated the failure, confirmed the issue, fixed the invalid state data in its verification system, and approved new state/locality values to issue a replacement certificate. Entrust also sent a preliminary report to the original reporter on 27 September 2020 confirming the issue and stating the certificate would be revoked. Entrust later described CRM workflow changes and training for agents to ensure preliminary reports are provided within required timeframes, and Mozilla indicated it intended to close the matter around 27 January 2021. The bug is resolved as FIXED.

1. 2020-09-26 Entrust received an incident alert about a certificate issued with an invalid ST/state value and began internal escalation and review.
2. 2020-09-27 Entrust assigned the Bugzilla incident after determining it did not notify the original reporter with a preliminary report within 24 hours.
3. 2020-10-01 Entrust reported ongoing design work for CRM workflow changes to address the preliminary-report process gap.
4. 2021-01-15 Entrust confirmed the CRM changes were live and behaving as expected, with agent training completed.
5. 2021-01-22 Mozilla indicated it intended to close the matter after confirming remediation steps were completed.

1. 2020-09-27 Fozzie representative — Reported that after submitting a certificate problem report and additional details, they had not received a preliminary report by ~32 hours after their response.
2. 2020-09-27 Entrustdatacard representative — Acknowledged the failure, cited BR 4.9.5, and said Entrust would investigate and post a summary in the thread.
3. 2020-10-01 Entrustdatacard representative — Provided a response describing planned CRM workflow changes and noted no definitive implementation date yet.
4. 2020-10-28 Entrustdatacard representative — Kicked off formal requirements review with IT and stated IT would start design/implementation in the next sprint starting 5 November, targeting January 2021.
5. 2020-12-08 Entrustdatacard representative — Updated that CRM changes were being worked on and should be ready for review soon, reaffirming a January 2021 target.
6. 2021-01-06 Entrustdatacard representative — Confirmed CRM changes would go live on 13 January 2021 and said training would be provided to agents managing certificate problem report intake.
7. 2021-01-15 Entrustdatacard representative — Confirmed CRM changes were live, showed the UI and email escalations before deadlines, and stated agent training was provided prior to launch.
8. 2021-01-22 Mozilla representative — Said remediation steps described in Comment 2 appeared completed and intended to close the matter around 27-Jan-2021.