IdenTrust: CT Logging Mistakes
IdenTrust self-disclosed an incident related to its Certificate Transparency (CT) log configuration. The CA reviewed its CT log activity after a public discussion and confirmed a similar issue: a customer reported encountering the error net::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED after deploying TLS certificates issued by IdenTrust. The root cause was the inclusion of a CT log with a “Qualified” status for 2027 rather than one marked as “Usable.” IdenTrust remediated the issue by removing the “Qualified” log from its configuration and instructing the customer to replace the affected certificates. The incident report states that issuance remained unaffected because the CT log was cleared from the internal list within two hours, and it describes revocation of affected internal and customer certificates on 2025-12-19 and 2025-12-30. In the closure summary, IdenTrust requested closure after stating that all disclosed action items were completed as described.
- IdenTrust enabled a CT log (“Argon2027h1”) with “Qualified” status in its systems.
- IdenTrust removed the “Argon2027h1” qualified CT log from its systems.
- IdenTrust revoked 46 internal certificates associated with the incident.
- IdenTrust revoked the remaining 3 certificates.
- IdenTrust Services, LLC — IdenTrust provided a preliminary incident report describing the CT logging mistake, the customer error net::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED, and initial remediation steps.
- IdenTrust Services, LLC — IdenTrust posted the full incident report with timeline, certificate counts, revocation details, and stated that issuance remained unaffected due to clearing the CT log within two hours.
- IdenTrust Services, LLC — IdenTrust created an attachment containing a full-qualified list CSV.
- IdenTrust Services, LLC — IdenTrust posted a report closure summary stating the incident cause, remediation (removing the Qualified log), and that action items were completed, requesting closure.
- CCADB representative — CCADB incident reporting issued a final call for comments or questions before closure.
- Mm representative — A commenter asked IdenTrust to expand on what the planned review process would entail and when using a Qualified log would be justified.
- IdenTrust Services, LLC — IdenTrust explained that the review would consider cases where Qualified logs may be appropriate due to limited usable logs, operator diversity needs, and early adoption testing with a new log operator.