← Entrust cases
Bugzilla #1906467
Ca Certificate Compliance
Certificate Misissuance
Closure Request
Entrust: S/MIME mailbox address not in subjectAltName
RESOLVED
FIXED
Entrust
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Entrust reported a mis-issuance of an S/MIME certificate due to a mailbox address in the subject commonName not being included in the subjectAltName, violating the S/MIME Baseline Requirements. The issue was identified on July 2, 2024, through an internal certificate problem report, leading to a halt in S/MIME certificate issuance. The mis-issued certificate was revoked on July 8, 2024, within the required timeframe. Entrust has implemented pre-sign linting to prevent future occurrences and has completed all action items related to this incident.
Chronology
- Internal certificate problem report identified a potential mis-issuance.
- Investigation confirmed the mis-issuance, and S/MIME certificate issuance was halted.
- The mis-issued certificate was revoked.
- Pre-sign linting for S/MIME was successfully deployed.
Thread Activity
- Entrust representative — Preliminary incident report submitted detailing the mis-issuance.
- Entrust representative — The impacted certificate was revoked.
- Entrust representative — Pre-sign linting for S/MIME deployed, all actions completed.
Participants
Entrust representative
Internet Security Research Group
Thisisntrocket representative
Mozilla representative
External References
Similar Local Cases
Entrust: clientAuth TLS Certificates without serverAuth EKU
Entrust: Delay in Updating CPS
Entrust: CPS typographical (text placement) error
Entrust: S/MIME mailbox address case mismatch between subject and subjectAltName
Entrust: S/MIME certificates lacking OU verification
Entrust: Incorrect Business Category Value Discovered in an EV SSL Certificate
Entrust: Invalid localityName
Entrust: SSL Certificates issued with Un-verified IP Addresses