← IdenTrust Services, LLC cases
Bugzilla #1895006
Certificate Misissuance
IdenTrust: unintended creation of a Root CA certificate
RESOLVED
FIXED
IdenTrust Services, LLC
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
On April 30, 2024, during a key ceremony, IdenTrust inadvertently created a self-signed Root CA certificate instead of the intended Subordinate CA due to a command error. This new certificate did not comply with the Server Certificate Baseline Requirements. IdenTrust disclosed the incident in the Common CA Database (CCADB) and requested its placement on the OneCRL. The malformed certificate was revoked, and a full incident report detailing the root cause and corrective actions is expected by May 17, 2024. IdenTrust has since implemented changes to their certificate creation processes to prevent similar issues in the future.
Chronology
- IdenTrust inadvertently created a self-signed Root CA certificate during a key ceremony.
- IdenTrust disclosed the incident in the CCADB.
- The malformed Root CA certificate was revoked.
- IdenTrust is expected to submit a full incident report.
Thread Activity
- IdenTrust Services, LLC — An unintended event occurred during a key ceremony, resulting in the creation of a new self-signed Root CA certificate.
- Community commenter — Concerns were raised about the implications of the incident and the need for a detailed explanation.
- IdenTrust Services, LLC — IdenTrust confirmed the misissuance of the subordinate CA certificate and stated it has been revoked.
- IdenTrust Services, LLC — A detailed incident report was promised to be submitted by May 17, 2024.
Participants
IdenTrust Services, LLC
Mm representative
Sectigo
Community commenter
HARICA
DigiCert
Mozilla representative
External References
Similar Local Cases
IdenTrust: EV TLS certificate with wrong jurisdiction state for private organization
IdenTrust: Approval of TLS certificate renewal without domain validation
IdenTrust: Certificates with Invalid values for stateOrProvinceName
IdenTrust: Invalid special characters in S/MIME Certificates
IdenTrust: S/MIME certificates issued in violation of New S/MIME Baseline Requirements v1.0
IdenTrust: Issuance of certificates greater than 398 days
IdenTrust: EV TLS certificate with invalid Jurisdiction state for government entity
IdenTrust: duplicate Certificate in error flagged by OCSP Watch