Entrust: Subscriber provides private key with CSR

Entrust reported a significant incident where a subscriber inadvertently included a private key with their Certificate Signing Request (CSR), leading to the issuance of 121 compromised certificates. The issue was identified on October 19, 2020, and subsequent investigations revealed that the same private key had been used in previous requests. Entrust promptly revoked all affected certificates and implemented a patch to prevent future occurrences. The incident highlighted the need for stricter validation of CSRs to avoid similar misissuances.

1. 2020-10-19 Entrust discovers private key included with CSR.
2. 2020-10-20 Trigger Certificate revoked.
3. 2020-10-23 All affected certificates confirmed revoked.
4. 2020-10-23 Patch installed to reject CSRs with extra data.