← Entrust cases
Bugzilla #1888714
Certificate Misissuance
Entrust: EV Certificate missing Issuer’s EV Policy OID
RESOLVED
FIXED
Entrust
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Entrust disclosed a compliance issue regarding its EV TLS certificates, which were issued without the required issuer's EV policy identifier (OID) between September 11 and September 22, 2023. This misissuance was identified by Entrust itself, prompting the CA to initiate a bug report. The affected certificates are being replaced and revoked, with confirmation that the correct OID has been included in all EV certificate profiles since March 18, 2024. Entrust is also preparing a full incident report detailing all impacted certificates. The issue arose from a misinterpretation of the guidelines, leading to the removal of the Entrust EV certificate policy identifier from its certificates.
Chronology
- Certificates issued without the Entrust EV policy identifier.
- Entrust includes the correct EV policy identifier in all EV certificate profiles.
Thread Activity
- Entrust representative — Entrust reports the missing EV policy OID in its certificates.
- Entrust representative — Entrust provides an incident report and confirms corrective actions.
- Entrust representative — All actions related to the incident have been completed.
Participants
Entrust representative
Staff representative
Google representative
Sectigo
Mozilla representative
External References
Similar Local Cases
Entrust: Delay in Updating CPS
Entrust: Failure to revoke EV TLS certificates issued before CPS update
Entrust: CPS typographical (text placement) error
Entrust: SSL Certificates issued with Un-verified IP Addresses
Entrust: S/MIME mailbox address not in subjectAltName
Entrust: S/MIME mailbox address case mismatch between subject and subjectAltName
Entrust: S/MIME certificates lacking OU verification
Entrust: clientAuth TLS Certificates without serverAuth EKU