IdenTrust: Missing Revocation Reasons in CRL

IdenTrust reported a compliance issue it discovered in its own certificate revocation lists (CRLs). During a routine quality check, it found that a CRL created on 10/2/2022 for the “HydrantID Server CA O1” ICA was missing the revocation reasons for all listed revoked certificates, which it stated violates Mozilla Root Store Policy Section 6.1.1 and IdenTrust CPS Section 4.9.3. IdenTrust said it confirmed that current CRLs are correct and that the initial indications pointed to a software change control deployed on 10/1/2022. In its incident report, IdenTrust attributed the problem to a database update during the weekend change control that did not execute as expected, and it remediated by correctly executing the database update. It also stated that it added a step for future change controls to validate the presence of revocation reasons on CRLs. The bug was resolved as FIXED, and IdenTrust indicated there were no additional items for the issue.

1. 2022-10-01 IdenTrust deployed a release intended to update revocation reason codes for Mozilla Root Store Policy v2.8 compliance.
2. 2022-10-02 A CRL for “HydrantID Server CA O1” was generated with missing revocation reasons.
3. 2022-10-03 IdenTrust investigated and remediated by correctly executing the database update that had failed to run as expected.
4. 2022-10-04 IdenTrust confirmed the 10/2/2022 CRL for “HydrantID Server CA O1” was missing revocation reasons.

1. 2022-10-06 IdenTrust Services, LLC — IdenTrust reported that it discovered at least one CRL with missing revocation reasons for all listed revoked certificates and said it would provide a formal incident report by 10/14/2022.
2. 2022-10-14 IdenTrust Services, LLC — IdenTrust provided a full incident report describing the routine quality check discovery, the timeline of the failed database update during change control, remediation, and a future validation step for CRL revocation reasons.
3. 2022-10-24 IdenTrust Services, LLC — IdenTrust stated it had no additional items for the issue.
4. 2022-10-26 Mozilla representative — Mozilla indicated it would close the bug on or about 2-Nov-2022.