Entrust: Test Website Certificates Expired

This case concerns Entrust test website certificates that expired. Entrust said it reviewed prior incident reports (Bugzilla 1730291 and 1726333) and realized it had similar expired test website certificate incidents but did not understand that an incident report was required. Entrust stated it will update its policy and practices to ensure expired test website certificates are treated as incidents and that future compliance requirements are covered. Entrust provided a timeline, including awareness of expired certificates in September 2019 and March 2020, and said it completed a migration project in May 2020 and reissued the expired test certificates on 29 May 2020. Entrust also stated the incident did not affect certificate issuance and described new operational controls, including issuing test CAs on the same platform as customer CAs, using an enterprise account with 60/30/10-day expiry notifications, and implementing monitoring for test website certificates. Mozilla closed the bug as FIXED/RESOLVED after reviewing the incident report and questions raised in the thread.

1. 2019-09-07 Entrust became aware that eight certificates supporting AffirmTrust root test sites had expired.
2. 2020-03-25 Entrust became aware that two certificates supporting Entrust root test sites had expired.
3. 2020-05-29 Entrust completed a migration project for test CAs and reissued expired test certificates.
4. 2021-09-21 Entrust opened the bug to disclose the expired test certificate incident and commit to policy/practice updates.

1. 2021-09-21 Entrust representative — Entrust disclosed that test website certificates had expired, said it previously misunderstood the need to file an incident report, and committed to update its policy and provide a full incident report by 28 September 2021.
2. 2021-09-22 Thisisntrocket representative — A reviewer asked for information on how the misunderstanding occurred and how it was not detected earlier.
3. 2021-09-23 Entrust representative — Entrust explained that earlier practices focused on mis-issued certificates and that it missed that expiring test website certificates should be treated as an incident, but said it recognized this via monitoring incident reports and would update practices.
4. 2021-09-28 Entrust representative — Entrust provided detailed incident information, including awareness dates, actions taken (migration and reissuance), and future controls to prevent test website certificate expiry.
5. 2021-09-29 Mozilla representative — Mozilla commented that the incident report was helpful, referenced a resource for test websites, and asked whether additional lessons could be learned.
6. 2021-10-14 Mozilla representative — Mozilla stated it would close the bug on 20-Oct-2021.