Entrust: Jurisdiction issue in some EV TLS & Code Signing certificates

Entrust identified a compliance issue involving 101 EV TLS certificates and 5 Code Signing EV certificates where the jurisdiction locality was incorrectly included, and the jurisdiction state or province field was missing. This was discovered during a routine scan with pkilint. Entrust confirmed the mis-issuance on May 16, 2024, and all affected certificates were revoked or expired by May 21, 2024. Entrust is preparing a full incident report and has implemented corrective measures to prevent future occurrences. They also filed reports for delayed reporting and revocation due to the timing of their internal processes.

1. 2024-05-16 Entrust confirmed the mis-issuance of certificates.
2. 2024-05-21 All affected certificates were revoked or expired.

1. 2024-05-19 Entrust representative — During a scan, we discovered 74 certificates with jurisdiction locality present and state/province missing.
2. 2024-05-22 Entrust representative — All affected certificates had expired or were revoked by May 21, 2024.
3. 2024-05-25 Entrust representative — We posted the full incident report detailing the findings and corrective actions.
4. 2024-06-28 Entrust representative — We acknowledged the failure to notify relevant Root Programs about the incident.
5. 2024-07-31 Entrust representative — All action items have been addressed, and we requested the incident be closed.