← Entrust cases
Bugzilla #1889217
Incident
Entrust: CRL non-conformance with the TLS BRs
RESOLVED
FIXED
Entrust
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Entrust disclosed a compliance issue regarding two of its Certificate Revocation Lists (CRLs) that contained a revoked certificates field without any revoked certificates, violating RFC 5280 and TLS BRs. The issue was detected through the use of linting software and manual investigation. Entrust investigated the problem, identifying a bug in their CRL generation system. They updated the software to ensure compliance and issued new CRLs. An incident report detailing the root cause and corrective actions was prepared and shared, confirming no security impact from the issue.
Chronology
- Entrust disclosed a CRL compliance issue to the CCADB.
- Entrust updated its CRL generation software and published compliant CRLs.
- Entrust submitted an incident report detailing the issue and corrective actions.
Thread Activity
- Google representative — Reported CRL compliance issue regarding revoked certificates field.
- Entrust representative — Acknowledged the issue and stated that an investigation was underway.
- Entrust representative — Confirmed the issue was due to a bug in the CRL generation system and that updates were made.
- Entrust representative — Shared the incident report detailing the findings and corrective actions.
- Mozilla representative — Closed the bug but noted it will remain on the list of Entrust compliance issues.
Participants
Community commenter
External References
Similar Local Cases
Asseco DS / Certum: CRL non-conformance with the TLS BRs
Entrust: CRLs and OCSP responses not issued as specified in the CPS
Entrust: Failed to provide a preliminary incident report according to TLS BR 4.9.5
Entrust: Test Website Certificates Expired
DigiCert: "Some-State" in stateOrProvinceName
GlobalSign: RSA-1024 leaf certificate issued after 2013-12-31
HARICA: 3 EV TLS Certificates without L or ST
GlobalSign: SHA-256 hash algorithm used with ECC P-384 key