IdenTrust: test certificates inadvertently published in production environment

IdenTrust reported that some test S/MIME and TLS certificates were mistakenly issued in its CA production environment instead of the designated CA test environment, bypassing the CA/B Forum BRs vetting processes. IdenTrust stated that the uncovered certificates were automatically revoked within minutes (and in some cases within seconds) of issuance, and that it believed the impact on trustworthiness was minimal due to the short lifetime. IdenTrust later confirmed the root cause as QA test automation scripts being run in the production environment, and identified that QA had temporary access to the production environment certificate application API for one-time work that had already been completed. As remediation, IdenTrust revoked QA access to the production environment and blocked reauthorization going forward using technical means, and it performed a comprehensive examination of its certificate database to confirm no additional certificates were issued in this manner. IdenTrust disclosed the incident to CCADB via this bug report and later stated it had no further remediation actions pending. Mozilla indicated it would close the bug on or about March 15, 2024 unless additional items were discussed. The bug was resolved as FIXED.

1. 2024-01-22 IdenTrust confirmed that test S/MIME certificates containing test data were inadvertently published in the production environment instead of the test environment.
2. 2024-01-23 IdenTrust’s investigation identified additional inadvertently issued S/MIME certificates and a similarly issued TLS certificate, all revoked shortly after publication.
3. 2024-01-26 IdenTrust determined QA test scripts were mistakenly published in production and identified temporary QA API access as the source of the wrong-environment issue.
4. 2024-02-11 IdenTrust completed its comprehensive analysis and found no evidence of other S/MIME or TLS certificates issued in this manner.
5. 2024-02-22 IdenTrust stated there were no further remediation actions pending for the issue.

1. 2024-01-26 IdenTrust Services, LLC — IdenTrust opened a preliminary incident report stating test S/MIME and TLS certificates were mistakenly issued in production instead of the test environment and that they were revoked within minutes.
2. 2024-01-27 IdenTrust Services, LLC — IdenTrust said it would post a complete incident report no later than February 16, 2024.
3. 2024-02-15 IdenTrust Services, LLC — IdenTrust provided a complete incident report with a timeline, stated the root cause (QA automation scripts run in production), described remediation (revoking QA production access and blocking reauthorization), and reported that a database examination found no other affected certificates.
4. 2024-02-22 IdenTrust Services, LLC — IdenTrust stated it had no further remediation actions pending for this issue.
5. 2024-03-14 Mozilla representative — Mozilla indicated it would close the bug on or about Friday, 15-March-2024 unless additional items were discussed.