Entrust: TLS certificate issued with an incorrect state or province
Entrust reported that it issued a TLS certificate where the state or province value was not included on a pre-approved list. Entrust became aware of the problem on 15 September 2022 at 12:01 UTC when a post-issuance linter detected the issue. Entrust confirmed the problem on 15 September 2022 and reissued the certificate on 15 September 2022. Entrust revoked the impacted certificate on 20 September 2022. Entrust stated it had not stopped issuance, and said it would continue post-issuance linting and revoke similar issues within 24 hours until development work to only accept pre-approved state/province values was completed and deployed. Entrust later reported that the relevant system migration was completed on 4 November 2022, with one remaining migration avenue deployed on 14 March 2023. The bug was resolved as FIXED, and Mozilla indicated it would close the case on or about 19-Apr-2023 unless other items remained to discuss.
- Post-issuance linter detected that a TLS certificate’s state/province value was not on the pre-approved list.
- Entrust confirmed the issue and reissued the certificate.
- Entrust revoked the impacted certificate.
- Entrust migrated the certificate request system component related to completing the ST field from a pre-approved list.
- Entrust deployed the remaining ST-field functionality.
- Entrust representative — Entrust described how the post-issuance linter detected the incorrect state/province value, provided a timeline, stated it had not stopped issuance, and outlined remediation including migrating the system to use a pre-approved dropdown for the ST field.
- Entrust representative — Entrust reported the system migration was completed on 4 November 2022, noted one remaining migration avenue later in 2023, and said it would continue post-issuance linting and revoke any mis-issued certificates.
- Entrust representative — Entrust replied that the remaining functionality was deployed on 14 March 2023.
- Mozilla representative — Mozilla stated it would close the bug on or about 19-Apr-2023 unless other items needed discussion.