← Entrust cases
Bugzilla #1952635
Self Reported Incident
Entrust: Missing or Inconsistent Disclosure of S/MIME BR Audits
RESOLVED
FIXED
Entrust
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Entrust reported an inconsistency in their S/MIME Baseline Requirements (BR) audit report, specifically regarding the omission of certain roots trusted for S/MIME. The issue was identified on March 5, 2025, following a notice received from a third party. Entrust acknowledged that six roots, which have S/MIME issuance capabilities but have not issued any S/MIME CA certificates, were mistakenly excluded from the audit scope. The CA has committed to including these roots in the upcoming audit report due by May 31, 2025, and has updated its compliance procedures to prevent future omissions. No mis-issued certificates were involved in this incident.
Chronology
- Entrust identified missing roots in their S/MIME BR audit report.
- Entrust plans to post an updated S/MIME BR audit report.
Thread Activity
- Entrust representative — Entrust received notice about the missing roots in the S/MIME BR audit report.
- Entrust representative — Entrust completed action items related to the incident and requested closure of the bug.
Participants
Entrust representative
External References
Similar Local Cases
Entrust: IP Address in dNSName form
Entrust: Jurisdiction issue in some EV TLS & Code Signing certificates
Entrust: OCSP response signed with SHA-1
Entrust: Not updating CPR Problem Reporting Mechanism fields in CCADB
Entrust: Improperly Verified Business Category
Entrust: Incomplete privileged access removal within 24 hours
Entrust: Jurisdiction Locality Wrong in EV Certificate
Entrust: S/MIME Certificate Issued with Incorrect Policy OID