Entrust: CRLs and OCSP responses not issued as specified in the CPS

This case concerns Entrust’s issuance of CRLs and OCSP responses with a validity period that was 1 second greater than specified in its CPS. Entrust said it became aware of the problem by reviewing Mozilla Incident Reports, then reviewed the CPS, CRLs, and OCSP responses and determined the issuance timing was off by one second. Entrust stated it did not stop certificate issuance because it reported no miss-issuance of any certificates, and it said only CRLs were impacted. Entrust explained that the CPS states a maximum validity period for CRLs and OCSP responses, and that its implementation added the maximum time to the notBefore value without considering that the last second was inclusive per RFC 5280. To remediate, Entrust re-issued the root CRLs and OCSP responses to be in compliance with the CPS and stated it would plan to comply with a CA/Browser Forum ballot if and when it was released. The bug was later scheduled for closure by Mozilla, and the bug’s resolution is FIXED.

1. 2021-09-18 Google Trust Services filed incident Bug 1731164.
2. 2021-09-27 Certainly filed incident Bug 1732745; GTS and Certainly incidents were reviewed and investigation started.
3. 2021-10-07 CA/Browser Forum Validation Subcommittee discussed the issue and a draft ballot was drafted.
4. 2021-10-21 Entrust posted a full incident report after reviewing the CPS, CRLs, and OCSP responses.
5. 2022-02-28 Entrust re-issued root CRLs and OCSP responses to comply with the CPS.

1. 2021-10-21 Entrust representative — Entrust reported that CRLs and OCSP responses were issued 1 second greater than specified in the CPS and described its investigation and remediation plan.
2. 2021-11-05 Mozilla representative — Mozilla noted the bug’s severity field was not set and asked for a review.
3. 2022-02-11 Mozilla representative — Mozilla asked whether Entrust had sufficiently remedied the issue and whether the bug could be closed.
4. 2022-02-11 Entrust representative — Entrust responded that it would take its own action due to ballot delay and would provide a follow-on update.
5. 2022-02-28 Entrust representative — Entrust stated it re-issued root CRLs and OCSP responses to be in compliance with the CPS and that there were no more current actions.
6. 2022-02-28 Mozilla representative — Mozilla said it would schedule the bug for closure on 4-March-2022 unless other issues remained.