Entrust: Late Revocation for SSL Certificates issued with Un-verified IP Addresses

This case involves Entrust's late revocation of SSL certificates that were issued without proper IP address verification. The issue was initially discovered through an internal audit and reported in a separate Bugzilla case. Entrust revoked 10 out of 12 affected certificates and later acknowledged that two certificates should have been revoked as well. The CA has since updated its practices to prevent future occurrences of retroactive validation, which contributed to the late revocation. The case has been resolved with Entrust committing to improved compliance measures.

1. 2021-12-30 Entrust advised subscribers of the impending revocation of certificates.
2. 2022-01-04 Entrust revoked 10 certificates and verified IP addresses for 2 certificates.

1. 2022-01-05 Entrust representative — Entrust reported the incident and outlined the timeline of actions taken.
2. 2022-01-07 Thisisntrocket representative — Questioned Entrust's decision-making regarding retroactive validation.
3. 2022-01-10 Entrust representative — Clarified that Entrust did not consider the two certificates problematic after retroactive verification.
4. 2022-01-17 Entrust representative — Proposed closure of the incident as no further updates were available.
5. 2022-01-19 Community commenter — Highlighted concerns about Entrust's decision-making process and systemic issues.
6. 2022-02-24 Entrust representative — Confirmed that Entrust has changed its policy to prevent retroactive validation.