Entrust: Jurisdiction Locality Wrong in EV Certificate
During routine reverification on 2023-11-17, Entrust identified that the Jurisdiction locality field for an account contained a “postal code” where the field should have contained a “City” name or “Null.” Entrust investigated and determined the error originated on 2023-07-09 when a manual contact change request led a verification team member to enter a postal code in the Jurisdiction locality field. Entrust reported that this resulted in the miss-issuance of two EV TLD certificates and one EV Code signing certificate. Entrust’s director of compliance advised revoking the certificates within 5 days, and Entrust revoked all affected certificates on 2023-11-26. Entrust also documented root cause analysis and lessons learned, including that a verification specialist entered the wrong value and the verification auditor did not detect the error. The thread states that Entrust completed independent updates to 340 additional accounts on 2023-12-07 and released a software update on 2024-01-18 to highlight changed fields for better review visibility; Mozilla indicated the matter could be closed on or about 2024-01-24. The bug is marked RESOLVED with resolution FIXED.
- Entrust identified during routine reverification that an account’s EV Jurisdiction locality field contained a postal code instead of a city name or Null.
- Entrust revoked the affected EV TLD and EV Code signing certificates.
- Entrust completed independent updates to 340 additional accounts requiring the same correction.
- Entrust released a software update to highlight changed fields in tickets for improved review visibility.
- Entrust representative — Bruce Morton reported that routine reverification found the Jurisdiction locality field wrong, traced it to a manual contact-change error on 2023-07-09, stated three EV certificates were miss-issued, and described revocation and root-cause analysis plus action items.
- Entrust representative — Bruce listed action items including updating all 340 additional accounts and releasing a software update to highlight changed fields.
- Entrust representative — Bruce stated that independent reverification of all 340 accounts was completed on 7 December 2023.
- Community commenter — Mathew Hodson asked whether Entrust considered linting to detect known invalid values in the locality field and whether such lints already exist.
- Entrust representative — Bruce responded that Entrust has lints on validated data but they would not fix this issue, and said they were considering using a service to ensure locality fields match the verified country, while still working on a plan.
- Entrust representative — Bruce stated the software update was released on 18 January 2024 to close the action and that all actions were now closed.
- Mozilla representative — Mozilla’s bwilson said the matter could be closed and would close it on or about 24-Jan-2024.