Entrust: Improperly Verified Business Category (EV Code Signing and VMC)
Entrust reported an incident in which EV Code Signing and VMC subscribers were verified using the incorrect business category under the Code Signing Baseline Requirements and the VMC Requirements. The incident was triggered by re-verification required due to mis-issued certificates in bug 1918380, which led Entrust to discover that some subscribers had incomplete Business Entity verification and that the wrong business category had been selected. Entrust stated that all mis-issued certificates were revoked due to bug 1918380, and that affected subscribers were re-verified or put into the process for re-verification. Entrust’s root cause analysis described that the verification system defaulted Business Category to “none” and allowed a verification specialist to select a business category before completing organization verification, and that Business Entity verification required face-to-face validation that was not captured by the verification system instructions. Entrust implemented remediation including updating verification procedures, retraining the verification team on Business Category selection and Business Entity verification, and discontinuing servicing Business Entity applicants (with manual deprecation and removal from its certificate management service). The bug was requested for closure after Entrust stated all disclosed action items were completed, and Mozilla indicated it would close the bug on or about 17-Mar-2025.
- Entrust verification advised that two subscribers categorized as Business Entities did not complete required principal individual verification.
- Entrust provided investigation of subscribers categorized as Business Entities.
- Entrust completed its investigation, confirmed non-compliant certificates were revoked per bug 1918380, and identified needed improvements to business category selection and validation.
- Entrust disclosed the incident report in this bug and described impacts and remediation actions.
- Entrust updated action items and stated it planned to discontinue servicing Business Entity subscribers to mitigate wrong-category risk.
- Entrust reported manual deprecation of Business Entity, and that Business Entity would be removed from its certificate management service, delaying closure until technical removal.
- Entrust reported that all action items were completed and requested bug closure.
- Mozilla indicated it would close the bug on or about 17-Mar-2025.
- Community commenter — Entrust posted an incident report describing incorrect business category verification for EV Code Signing and VMC subscribers, incomplete Business Entity verification in some cases, impacts, and remediation action items.
- Community commenter — Entrust said it was working on a solution and would update in 2–3 weeks while continuing to monitor the bug.
- Community commenter — Entrust stated it was continuing to monitor the bug.
- Community commenter — Entrust said it was working on updating the system and continued monitoring.
- Community commenter — Entrust continued monitoring and work on the action to update the system.
- Community commenter — Entrust marked procedure update and retraining as done, and stated it planned to discontinue servicing Business Entity subscribers, with a follow-up on an implementation date.
- Community commenter — Entrust reported it no longer issues certificates to new Business Entity applicants meeting EV Guidelines, described manual deprecation and removal from its certificate management service, and delayed closure until technical removal.
- Community commenter — Entrust reported all action items were completed, summarized the incident and remediation, and requested bug closure.
- Mozilla representative — Mozilla said it would close the bug on or about Monday, 17-Mar-2025 unless there were comments or questions.