Entrust incident report for outdated CCADB Problem Reporting Mechanism fields
Entrust opened this case after being advised that its CCADB Problem Reporting Mechanism fields were misaligned with its CPS and contained outdated information. Entrust stated that no certificates were mis-issued, and that the issue was limited to the CCADB contact information not being kept in sync with the CPS. Mozilla later verified that the CCADB information had been updated. Entrust filed an incident report describing the root cause as the CCADB CA page not being reviewed regularly, and it committed to updating its process so the Problem Reporting Mechanism would be reviewed and updated within 14 days of change. The thread then focused on incident-response expectations, including whether an initial report should be filed within 72 hours, and Entrust said it would incorporate that timing into its remediation plan. Entrust later reported that all action items were completed and requested closure.
- Entrust was advised that its CCADB Problem Reporting Mechanism fields were misaligned with its CPS and outdated.
- A CCADB case was opened to update the Problem Reporting Mechanism fields.
- Mozilla confirmed the CCADB information had been updated.
- Entrust posted a closure summary stating that the incident report action items were completed.
- Entrust representative — Entrust said it had been advised of the CCADB mismatch, that a CCADB case had been submitted, that no certificates were mis-issued, and that it would provide an incident report.
- Mozilla representative — Mozilla said it could verify that the CCADB information had been updated.
- Entrust representative — Entrust filed an incident report explaining the outdated CCADB contact details, the impact, the timeline, root cause analysis, lessons learned, and an action item to update CCADB review tasks.
- Entrust representative — Entrust said it was improving procedures, that the CCADB CA Details page had not been reviewed regularly, and that it would add a 14-day update expectation and other remediation steps.
- Entrust representative — Entrust answered questions about the timeline, said reviewing the CCADB CA Details page would become part of the process, and said it would include a 72-hour initial-report requirement in its incident response process.
- Entrust representative — Entrust said the CPS v3.15 change was not included in the incident report and that the inconsistency highlighted a gap in its incident response process.
- Entrust representative — Entrust said all action items were completed, summarized the incident and remediation, and requested closure.
- Mozilla representative — Mozilla said it would close the bug on 2025-01-17 unless there were further questions or issues.