IdenTrust: Expired CRLs

IdenTrust reported that its monitoring alerted it that the CRL issued by the “IdenTrust Commercial Root CA 1” root had expired on 2022-09-16 14:00 MDT. The CA stated it had approximately 90 minutes during which there were 137K downloads of the expired CRL, which it described as a violation of CA/B Forum Baseline Requirements section 4.10.2. Id enTrust said it had created a new CRL on 2022-09-14 to replace the upcoming expiration, but after the alert on 2022-09-16 14:07 MDT it completed replacement at 2022-09-16 15:33 MDT. The CA attributed the problem to a notification failure: a monitor detected the impending CRL expiration, but the notification process failed because a mail system configuration was incorrect due to an automated configuration management update. In follow-up, Id enTrust stated it updated the mail system with the correct configuration and updated its configuration management platform to retain the correct configuration during future updates, and later said it had no further actions and considered the issue resolved. Mozilla asked questions about how the incorrect configuration was applied and about testing of the notification system; Id enTrust responded with details about master/client configuration sync and said the notification system was thoroughly tested. The bug was marked RESOLVED with resolution FIXED, and a Mozilla comment indicated it would be closed on or about 2-Nov-2022.

1. 2022-09-14 IdenTrust created a new CRL to replace the upcoming CRL expiration for IdenTrust Commercial Root CA 1.
2. 2022-09-16 The IdenTrust Commercial Root CA 1 CRL expired and Id enTrust later completed replacement after receiving an external monitor alert.
3. 2022-09-30 IdenTrust reported remediation steps, including correcting mail system configuration and updating configuration management.
4. 2022-10-20 IdenTrust stated the issue does not require any additional remediation.
5. 2022-10-26 Mozilla indicated it would close the bug on or about 2-Nov-2022.

1. 2022-09-22 IdenTrust Services, LLC — IdenTrust disclosed that monitoring alerted it to an expired CRL for “IdenTrust Commercial Root CA 1,” described the timeline and impact (137K downloads during ~90 minutes), and explained the incident as a violation of CA/B Forum Baseline Requirements section 4.10.2.
2. 2022-09-30 IdenTrust Services, LLC — IdenTrust updated that the notification process failed due to an incorrect mail system configuration applied by automated configuration management, and stated the mail system configuration was corrected and the issue was resolved.
3. 2022-10-04 Google representative — Google asked how the incorrect configuration was applied, when the relevant system update occurred, whether notification worked before the update, and whether the notification system was tested.
4. 2022-10-06 IdenTrust Services, LLC — IdenTrust acknowledged receipt and said it would provide answers no later than 10/10/2022.
5. 2022-10-10 IdenTrust Services, LLC — IdenTrust explained master/client configuration sync issues that led to an old mail configuration being applied, provided the system update date (8/16/2022), and stated the notification system was thoroughly tested and automated configuration management was eliminated in the new design.
6. 2022-10-20 IdenTrust Services, LLC — IdenTrust stated the issue does not require any additional remediation.
7. 2022-10-26 Mozilla representative — Mozilla said it would close the bug on or about next Wed (2-Nov-2022).