Entrust: Subscriber provides private key with CSR

Entrust reported a compliance issue where a subscriber provided a private key along with a Certificate Signing Request (CSR), leading to the issuance of certificates with compromised keys. The issue was discovered on October 19, 2020, during a support escalation. Entrust took immediate action by revoking affected certificates and updating their systems to prevent future occurrences. A total of 121 certificates from Entrust and 12 from AffirmTrust were identified as problematic. The CA has since ceased issuing certificates with private keys included in CSRs and implemented stricter validation measures.

1. 2020-10-19 Entrust discovers private key was provided with CSR, leading to certificate revocation.
2. 2020-10-23 All affected certificates were revoked and a patch was installed to reject CSRs with extra data.

1. 2020-10-23 Entrust representative — Entrust compliance team reported the issue and outlined the timeline of actions taken.
2. 2020-10-26 Community commenter — Acknowledged the importance of the report and suggested methods for other CAs to check for similar issues.
3. 2020-10-29 Entrust representative — Provided updates on the investigation and measures taken to prevent future occurrences.
4. 2020-12-07 Mozilla representative — Indicated that the bug can be closed as all issues have been addressed.