IdenTrust: Cross-signed root certificate mis-issuance

IdenTrust Services, LLC self-disclosed a mis-issuance incident involving a cross-signed root certificate. The mis-issuance was identified during cert-chain validation testing, where it was found that an incorrect Certificate Signing Request (CSR) was used. The CA promptly revoked the mis-issued certificate and implemented hash validation checks in their signing scripts to prevent future occurrences. A full incident report was submitted on February 18, 2026, detailing the incident and corrective actions taken. The case is now resolved with all action items completed.

1. 2026-01-29 Issued the cross-signed certificate
2. 2026-02-02 Discovered the mis-issuance
3. 2026-02-03 Revoked the mis-issued certificate
4. 2026-02-18 Submitted full incident report
5. 2026-04-02 Completed action items and requested closure

1. 2026-02-05 IdenTrust Services, LLC — Disclosed preliminary incident report regarding the mis-issuance.
2. 2026-02-18 IdenTrust Services, LLC — Submitted full incident report detailing the mis-issuance and corrective actions.
3. 2026-04-02 IdenTrust Services, LLC — Provided closure summary and confirmed completion of all action items.