IdenTrust: Mis-Issued EV Code Signing Certificate

IdenTrust reported that it issued an EV Code Signing certificate to HydrantID on 2022-10-18, and that post-issuance validation discovered the certificate had the wrong serial number for the jurisdiction of incorporation state. The issue was described as a violation of the Code Sign Baseline Requirements, referencing subject jurisdiction of incorporation and registration number requirements. In response, IdenTrust discovered and reported the discrepancy to its internal compliance team, updated the HydrantID organization database record, updated its EV registration validation process to prevent recurrence, and replaced/revoked the EV Code Signing certificate on 2022-10-19. IdenTrust stated that the organization re-verification completed on 2021-11-11 failed to update the registration number from Utah to the registration number for Delaware, and that this was not identified earlier because no other certificates were vetted and issued between 2021-11-11 and the request. IdenTrust also described future steps to review and compare validation documentation against system data and update documentation/system data as applicable. Mozilla asked how the community wanted to resolve the issue, and the bug was later closed as fixed.

1. 2022-10-18 IdenTrust issued an EV Code Signing certificate to HydrantID that later failed post-issuance validation due to a jurisdiction/registration serial number discrepancy.
2. 2022-10-19 IdenTrust replaced/revoked the EV Code Signing certificate and updated its EV registration validation process to prevent recurrence.

1. 2022-10-20 IdenTrust Services, LLC — IdenTrust reported that the 2022-10-18 EV Code Signing certificate for HydrantID had the wrong serial number for the jurisdiction of incorporation state and described its remediation and prevention steps.
2. 2022-10-21 Mozilla representative — Mozilla asked how the community wanted to resolve the issue.
3. 2022-10-21 DigiCert — Corey Bonnell stated they did not believe an incident report was required because the certificate did not contain an EKU that puts it in scope of Mozilla policy.
4. 2022-10-26 IdenTrust Services, LLC — IdenTrust asked whether the bug could be closed.
5. 2022-10-26 Mozilla representative — Mozilla confirmed it would close the bug and thanked Ben.