IdenTrust: Mis-Issued EV Certificates

IdenTrust Services, LLC identified a compliance failure involving the mis-issuance of 124 Extended Validation (EV) certificates due to a failure in their system to trigger re-validation of documentation older than 398 days. The issue was discovered during an internal audit on September 27, 2021, and the bug report was filed on October 8, 2021. IdenTrust implemented a remediation plan, which included revoking the mis-issued certificates and enhancing their systems to prevent future occurrences. As of November 10, 2021, all but three certificates had been revoked, and the remaining certificates were revoked shortly thereafter. The technical controls to prevent recurrence were deployed on January 20, 2022, resolving the issue.

1. 2021-09-27 IdenTrust discovered mis-issuance of 124 EV certificates during an internal audit.
2. 2021-10-08 IdenTrust filed a bug report disclosing the mis-issuance incident.
3. 2022-01-20 IdenTrust deployed automated validation controls to prevent future mis-issuance.

1. 2021-10-08 IdenTrust Services, LLC — IdenTrust reported the mis-issuance of 124 EV certificates due to a compliance failure.
2. 2021-10-15 IdenTrust Services, LLC — IdenTrust provided a status update on the remediation plan for the mis-issued certificates.
3. 2021-11-10 IdenTrust Services, LLC — IdenTrust confirmed that all but 3 mis-issued certificates had been revoked.
4. 2022-01-21 IdenTrust Services, LLC — IdenTrust announced the deployment of automated validation controls to prevent recurrence.