Entrust: SSL Certificates issued with Un-verified IP Addresses

Entrust discovered that two EV SSL certificates were issued with un-verified IP addresses in the subjectAltName extension. This issue was identified on December 6, 2021, during a post-linting check. Following the discovery, Entrust revoked the problematic certificates and implemented a patch to prevent future occurrences. A late revocation incident report was created, and an automated negative test case for IP addresses was deployed. The incident has been resolved, and Entrust has committed to ensuring compliance with the Baseline Requirements moving forward.

1. 2021-12-06 Entrust identified the issuance of two EV SSL certificates with un-verified IP addresses.
2. 2022-01-04 Entrust revoked the two problematic certificates.
3. 2022-01-10 Entrust posted the late revocation incident report.
4. 2022-01-11 Entrust deployed an automated negative test case for IP addresses.

1. 2021-12-07 Entrust representative — Entrust became aware of the problem when post-linting checks indicated two EV SSL certificates issued with IP addresses.
2. 2021-12-10 Entrust representative — A timeline of actions taken in response to the issue was provided.
3. 2022-01-04 Entrust representative — Both certificates have been revoked today.
4. 2022-01-10 Entrust representative — We have posted the late revocation incident report.
5. 2022-01-11 Entrust representative — The automated negative test was deployed today.