IdenTrust: S/MIME Certificates issued without CAB Forum OID

IdenTrust reported that, while inspecting Enterprise certificates on 2023-10-23, it discovered that 1,135 S/MIME certificates issued to four Enterprise customers were missing the expected CA/B Forum OID after 2023-08-31. The CA stated that some customers were supposed to have been moved to a different certificate program and were not expected to use the publicly trusted ICA, but the API access to that publicly trusted ICA had not been disabled. Id enTrust disabled the API for the four affected Enterprise customers on 2023-10-23 21:30, notified customers of the revocation requirement by 2023-10-27, and confirmed that all affected certificates were revoked by 2023-10-27 23:30. The CA’s root cause analysis attributed the issue to not turning off an API that was no longer meant to be in use. The thread indicates there were no further pending actions and Mozilla planned to close the ticket unless there were objections. The bug was resolved as FIXED.

1. 2023-10-23 IdenTrust discovered 1,135 S/MIME certificates missing the expected CA/B Forum OID and identified four affected Enterprise customers.
2. 2023-10-23 IdenTrust disabled the API for the four affected Enterprise customers.
3. 2023-10-27 IdenTrust confirmed all affected certificates were revoked.

1. 2023-10-28 IdenTrust Services, LLC — Created the incident report attachment, describing discovery of missing S/MIME CA/B Forum OID, deactivation of the relevant API, customer notification of revocation requirements, and confirmation that all affected certificates were revoked.
2. 2023-11-30 IdenTrust Services, LLC — Stated there were no further pending actions for the issue.
3. 2023-12-19 IdenTrust Services, LLC — Asked Mozilla to close the ticket.
4. 2023-12-29 Mozilla representative — Indicated intent to close the ticket on Wed 3-Jan-2024 unless there were objections.