← Entrust cases
Bugzilla #1886467
Certificate Misissuance
Entrust: clientAuth TLS Certificates without serverAuth EKU
RESOLVED
FIXED
Entrust
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Entrust identified a compliance issue involving 15 EV certificates that were issued with the Extended Key Usage (EKU) attribute set to `id-kp-clientAuth` but lacking the required `id-kp-serverAuth` attribute. This issue was discovered during a review related to another incident. Entrust promptly halted the issuance of such certificates and began contacting affected customers to replace and revoke the non-compliant certificates. The incident was documented, and action items were established to improve compliance checks and prevent future occurrences. The issue was resolved, and all actions have been completed as of June 2024.
Chronology
- Entrust confirmed a compliance issue with clientAuth TLS certificates.
- Entrust requested closure of the incident after completing all actions.
Thread Activity
- Entrust representative — Created incident report detailing the compliance issue with clientAuth certificates.
- Entrust representative — Updated action item regarding fixing TLS BR EKU checking in zlint to done.
- Entrust representative — Requested closure of the incident after all actions were completed.
Participants
Entrust representative
Google representative
Community commenter
HARICA
Apple representative
External References
Similar Local Cases
Entrust: Delay in Updating CPS
Entrust: Failure to revoke EV TLS certificates issued before CPS update
Entrust: CPS typographical (text placement) error
Entrust: S/MIME mailbox address not in subjectAltName
Entrust: S/MIME mailbox address case mismatch between subject and subjectAltName
Entrust: SSL Certificates issued with Un-verified IP Addresses
Entrust: EV Certificate missing Issuer’s EV Policy OID
Entrust: S/MIME certificates lacking OU verification