← D-TRUST cases
Bugzilla #1924385
Certificate Problem Report
D-Trust: Missed Revocation of TLS certificates affected by Bugzilla 1884714
RESOLVED
FIXED
D-TRUST
AI Summary
D-Trust issued TLS certificates containing an LDAP-URL in the Subscriber Certificate Authority Information Access field after September 15, 2023. Upon discovery, D-Trust revoked 2,601 affected certificates within five days. However, four certificates issued on January 26 and March 1, 2024, went undetected during the mass revocation. The root cause was identified as communication issues between the Nexus CM and CSM, which were not detected during testing. D-Trust has since implemented measures to prevent future occurrences, including an error-tolerant data synchronization system.
Chronology
- Entry into force of the provisions from Ballot SC62
- All affected TLS certificates were revoked
- Discovery of 4 undetected affected certificates
- Revocation of the 4 undetected certificates
- Installation of error-tolerant data synchronization system in production
Participants
Enrico Entschew
Ryan Dickson
B. Wilson
External References
Similar Local Cases
D-Trust: Notice to affected Subscriber and person filing CPR not sent within 24 hours
D-Trust: LDAP-URL in Subscriber Certificate Authority Information Access field
D-TRUST: Wrong key usage (Key Encipherment)
D-TRUST: Certificate with RSA key where modulus is not divisible by 8
D-Trust: CRL-Entries without required CRL Reason Code
D-TRUST: syntax error in one tls certificate
D-Trust: Issuance of an EV certificate containing a mixup of the Subject's postalCode and localityName
D-Trust: QCStatement with http link of PKI Disclosure Statements