TunTrust: Issue with Valid test Certificate
TunTrust reported that its valid OV SSL test website certificate was being served as an expired certificate. The issue began after a maintenance operation on September 10, 2025 at 11:09 UTC triggered a DNS failover that redirected traffic to the Disaster Recovery (DR) site, where the DNS record still pointed to an outdated IP address. TunTrust stated that the domain validovssl.tuntrust.tn therefore served the expired certificate installed on the former host instead of the intended valid test certificate. The problem was externally reported on September 11, 2025 at 17:39 UTC, prompting TunTrust to investigate. TunTrust corrected the DNS records on September 11, 2025 at 20:09 UTC so the domain began serving the intended valid test certificate. TunTrust also described remediation action items including configuring external monitoring to verify certificate validity, updating the DNS failover verification procedure, and configuring the DR host to automatically obtain a valid certificate via ACME when publicly accessible. The bug is marked RESOLVED with resolution FIXED, and TunTrust requested closure after stating the action items were completed.
- A DNS failover during maintenance redirected traffic to the Disaster Recovery site, leading to the domain serving an expired certificate due to outdated DNS records.
- A problem was externally reported that the valid OV SSL test website was serving an expired certificate.
- TunTrust corrected DNS records to point to the correct public IP address, restoring service of the intended valid test certificate.
- External monitoring to continuously verify certificate validity was completed.
- DNS failover verification procedure updates and ACME auto-certificate configuration for the DR host were completed.
- Agence Nationale de Certification Electronique — TunTrust filed a preliminary incident report stating that the valid OV SSL test website was serving an expired certificate due to incorrect DNS records for the DR site, and that DNS was corrected on September 11, 2025 at 20:09 UTC.
- Agence Nationale de Certification Electronique — TunTrust posted a full incident report describing the ACME test certificate host/IP changes, the failover timing, the external report received on September 11, 2025 at 17:39 UTC, and the DNS correction at 20:09 UTC.
- Agence Nationale de Certification Electronique — TunTrust updated the incident report again, reiterating the incident timeline and details.
- Agence Nationale de Certification Electronique — TunTrust provided another updated full incident report including the same incident description and timeline.
- Agence Nationale de Certification Electronique — TunTrust posted a report closure summary stating the root causes and three remediation action items, with completion dates for external monitoring and DNS/ACME-related changes, and requested closure.
- CCADB representative — CCADB requested a final call for comments or questions before the incident report would be closed on approximately 2025-10-20.