Entrust: EV TLS certificates incorrectly indicated jurisdiction (misissuance)
Entrust reported that it became aware of a problem with Verified Mark Certificates (VMCs) on 10 November 2022, and later determined the issue affected EV verification certificates that include jurisdiction information. Entrust investigated and found that 322 EV certificates were miss-issued with the incorrect jurisdiction. Entrust stated it did not stop issuance, but that the issues discovered through investigation were corrected. Entrust said it planned to revoke within the 5-day requirement; however, it reported delays due to subscriber pushback, coordination with technical teams, and an end-of-year black-out period, and it opened a late revocation incident report (Bug 1804753). Entrust also stated that 62 certificates were revoked during the planned 5-day revocation period, and that 14 certificates were incorrectly indicated as miss-issued and therefore would not be revoked. Entrust reported that a new jurisdiction functionality was deployed on 14 March 2023 and that it would use an approved incorporating agencies matrix for jurisdiction data alignment and post-issuance linting. Mozilla indicated it would close the bug on 19-Apr-2023, and the bug is marked RESOLVED with resolution FIXED.
- Entrust became aware of a problem with VMC certificates.
- Entrust identified 322 EV certificates miss-issued with incorrect jurisdiction.
- Entrust reported revocation outcomes during the planned 5-day revocation period and identified 14 certificates that would not be revoked.
- Entrust posted an incident report for late revocation (Bug 1804753).
- Entrust deployed the new jurisdiction functionality.
- Mozilla planned to close the bug.
- Entrust representative — Bruce Morton described Entrust’s awareness of the VMC problem, the investigation into EV verification certificates with jurisdiction data, and stated 322 EV certificates were found miss-issued with incorrect jurisdiction.
- Thisisntrocket representative — Matthias asked what a VMC is and questioned why it took until 2022-11-28 to discover the problematic EV certificates, and whether revocation was planned.
- Entrust representative — Bruce Morton explained that VMC means Verified Mark Certificate, discussed why jurisdiction data was difficult to search, and said Entrust planned to revoke within the 5-day requirement but expected delays due to the end-of-year black-out period.
- Entrust representative — Bruce Morton stated that 14 certificates were incorrectly indicated as miss-issued and would not be revoked.
- Entrust representative — Bruce Morton reported that 62 certificates were revoked during the planned 5-day revocation period and that a delayed revocation incident report would be opened to track completion.
- Entrust representative — Bruce Morton noted that the incident was posted for late revocation and linked to Bug 1804753.
- Entrust representative — Bruce Morton described the planned “new design” to align jurisdiction data using an approved incorporating agencies matrix and outlined a verification process, with a target update date of 31 March 2023.
- Entrust representative — Bruce Morton stated the jurisdiction functionality was deployed on 14 March 2023.
- Mozilla representative — Mozilla’s bwilson said they would close the bug on 19-Apr-2023 unless other concerns were raised.