Entrust: CPR was not responded to within 24 hours
This case concerns a certificate problem report (CPR) sent to Entrust/AffirmTrust about a mis-issued EV SSL certificate and the lack of a preliminary response within 24 hours. The reporter said they emailed the CPS-listed abuse address and did not receive an acknowledgement in time, then opened this Bugzilla case. Entrust later confirmed receipt, explained that the support team had not recognized the email as a CPR, and said it was preparing an incident report. Entrust’s incident report stated that the reporter eventually received acknowledgement and updates, and it listed retraining and automation work as action items. Later comments said the retraining was completed early, the remaining automation work was finished, and Entrust had launched a new problem-reporting page to be added to its CPS and CCADB. Entrust then requested that the bug be closed, and Mozilla said it would close it on 2024-09-11.
- A CPR was emailed to Entrust/AffirmTrust about potentially mis-issued certificates.
- Entrust provided acknowledgement of the CPR to the reporter.
- Entrust posted an incident report describing the missed 24-hour CPR response and corrective actions.
- Entrust said its updated problem-reporting page was live and would be added to its CPS and CCADB.
- Entrust requested that the bug be closed.
- Community commenter — Reported that an email to a**********e@affirmtrust.com about a mis-issued certificate had not received any response or acknowledgement within 24 hours.
- Sectigo — Said the EV certificate-without-cPSuri issue looked like a duplicate of bug 1883843, but the missing acknowledgement at a**********e@affirmtrust.com appeared to be a separate issue.
- Community commenter — Agreed the duplicate part could be separate, and said the lack of response to the a**********e@affirmtrust.com endpoint still seemed to violate the CPR processing requirement.
- Entrust representative — Confirmed Entrust had seen the bug and asked that the title start with "Entrust:".
- Entrust representative — Posted an incident report saying the support team did not recognize the email as a CPR and did not provide a preliminary report within 24 hours.
- Entrust representative — Said Entrust had opened bug 1894111 and would complete an incident report that week.
- Entrust representative — Said the retraining action item had actually been completed on 2024-04-02.
- Entrust representative — Said both action items were done and that Entrust had launched a new problem-reporting page to be added to its CPS and CCADB.
- Entrust representative — Requested that the bug be closed.
- Mozilla representative — Said the bug would be closed on 2024-09-11.