Entrust: Delayed Revocation for EV TLS certificate incorrect jurisdiction
This case concerns Entrust’s delayed revocation of EV TLS certificates that had incorrect jurisdiction information. Entrust stated it discovered the incident in November and that revocation for some certificates was delayed due to blackout periods. Entrust reported contacting subscribers on 28 November 2022, advising them of the incident, the miss-issued certificates, and planned revocation dates, and it discussed revocation plans and status with compliance and subscribers. In response to questions about extension criteria, Entrust said it accepted subscriber requests because it was concerned that revoking during the blackout period would cause more harm to relying parties than leaving certificates in place with an EV jurisdiction error, and it stated it would not grant an extension for key compromise because compromised private keys are revoked within 24 hours of proving key compromise. Entrust provided revocation completion updates for multiple subscribers, including revocations completed on 2 December 2022, 4 December 2022, 15 January 2023, 6 February 2023, and 15 March 2023, with all certificates revoked. Mozilla indicated the incident could be closed and scheduled closure for 19-Apr-2023. The bug is resolved as FIXED.
- Entrust contacted subscribers about the EV TLS incorrect-jurisdiction incident and planned revocation dates.
- Entrust revoked Prudential Financial EV TLS certificates.
- Entrust completed revocation for ING Groep certificates.
- Entrust completed revocation for Munich Re Group certificates.
- Entrust revoked Azimut Holding certificates.
- Entrust revoked Experian certificates.
- Entrust revoked First Abu Dhabi Bank PJSC certificates.
- Entrust completed revocation for Fidelity Investments certificates; all certificates were revoked.
- Mozilla scheduled closure of the incident.
- Entrust representative — Bruce Morton created the incident report attachment, describing the incorrect-jurisdiction EV TLS incident and explaining that revocation for some certificates was delayed due to blackout periods.
- Entrust representative — Morton reported that Prudential Financial certificates were revoked on 2 December 2022, ING Groep completed revoking on 4 December 2022, Munich Re Group completed revoking on 16 December 2022, and Azimut Holding certificates were revoked on 17 December 2022.
- Sectigo — Katerbarg asked for clarification of Entrust’s criteria for granting subscriber extensions, including what made circumstances exceptional, how key-compromise scenarios would be handled, and why the incident was not opened within the 5-day revocation window.
- Entrust representative — Morton explained that Entrust accepted blackout-period extension requests due to concern about harm to relying parties, stated it would not extend for key compromise, and clarified that the plan was to revoke within 5 days but to open a delayed revocation incident if not.
- Entrust representative — Morton reported that Experian certificates were revoked on 15 January 2023.
- Entrust representative — Morton reported that First Abu Dhabi Bank PJSC certificates were revoked on 6 February 2023.
- Google representative — Chris Clements requested an update to the incident report items covering root cause and remaining next steps.
- Entrust representative — Morton stated that Fidelity Investments certificate revocation was completed on 15 March 2023 and that all certificates have been revoked.
- Mozilla representative — Mozilla asked for updates to the incident report items #6 and #7, and Entrust responded with details about why revocation could not occur within 5 days and the mitigation steps being taken.
- Mozilla representative — Mozilla stated the incident could be closed and scheduled closure for 19-Apr-2023.