Entrust: S/MIME certificates lacking OU verification

Entrust disclosed a compliance issue regarding 1,039 S/MIME certificates that were mis-issued due to the lack of verification of the organizational unit (OU) field, contrary to S/MIME Baseline Requirements. The issue was identified during an internal review, prompting Entrust to notify all affected subscribers and complete revocation of the mis-issued certificates. An incident report was created, detailing the root cause and outlining steps for remediation, including training personnel on updated compliance policies. All action items have been completed, and Entrust has requested closure of the incident.

1. 2024-08-20 Entrust completed revocation of mis-issued S/MIME certificates.

1. 2024-08-20 Entrust representative — Preliminary incident report submitted detailing the lack of OU verification.
2. 2024-09-30 Entrust representative — Action items for compliance training and policy updates were outlined.
3. 2025-02-25 Entrust representative — Incident report closure summary provided, confirming completion of all action items.
4. 2025-02-26 Mozilla representative — Confirmed closure of the bug on 28-Feb-2025.