← IdenTrust Services, LLC cases
Bugzilla #1851710
Certificate Misissuance
IdenTrust: Delay beyond 5 days in revoking misissued certificates
RESOLVED
FIXED
IdenTrust Services, LLC
AI Summary
IdenTrust faced a significant delay in revoking misissued certificates, which exceeded the 5-day requirement set by the Baseline Requirements. The delay was attributed to the need for careful replacement of certificates used in critical systems, which complicated the revocation process. As of late November 2023, IdenTrust reported that 100% of the affected certificates had been revoked, following a commitment to improve their processes for timely revocation in the future.
Chronology
- IdenTrust reported a compliance incident regarding misissued certificates.
- IdenTrust confirmed that 107 certificates had been revoked.
- IdenTrust committed to following Mozilla's revocation guidelines for future incidents.
- IdenTrust confirmed that 100% of the affected certificates had been revoked.
Participants
IdenTrust
External References
Similar Local Cases
IdenTrust: test certificates inadvertently published in production environment
IdenTrust: Mis-Issued EV Certificates
IdenTrust: Validation Source for EV Certificates not Publicly Disclosed
IdenTrust: ICA with invalid CDP
IdenTrust: Invalid special characters in S/MIME Certificates
IdenTrust: Improper encoding of wildcard certificate
IdenTrust: Issuance of certificates greater than 398 days
IdenTrust: Approval of TLS certificate renewal without domain validation