IdenTrust: Failure to Revoke Subscriber Certificates Within 5 days

IdenTrust faced issues with revoking mis-issued subscriber certificates within the required 5-day timeframe. The CA determined that revoking these certificates promptly would significantly disrupt customer services, leading to a decision to extend the revocation period to 30 days. This decision was made after a risk management review, which concluded that the certificates posed a low security risk. The CA has since updated its processes to ensure compliance with revocation timelines and has completed necessary updates to subscriber agreements.

1. 2021-09-27 IdenTrust became aware of the problem while formulating a remediation plan.
2. 2021-10-18 IdenTrust was reminded that revocation beyond 5 days requires a separate incident report.
3. 2021-12-30 Updated subscriber agreements for TLS certificates were put in place.