← IdenTrust Services, LLC cases
Bugzilla #2016585
Self Reported Incident
Incident
IdenTrust: Test Certificates from cross-signed roots not disclosed in CT Logs
RESOLVED
FIXED
IdenTrust Services, LLC
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
IdenTrust self-disclosed an incident involving test automation certificates that failed browser validation due to missing Certificate Transparency (CT) log entries. The issue was identified during a review and was limited to test certificates from a newly cross-signed TLS CA hierarchy. No customer certificates were affected. The CA revoked the impacted certificates and issued new ones with proper CT log submissions. A full incident report was disclosed on February 26, 2026, detailing the timeline and remediation steps taken, including the implementation of post-issuance CT linting to prevent future occurrences.
Chronology
- Non-compliance start date identified.
- Non-compliance identified and affected certificates revoked.
- Full incident report disclosed.
Thread Activity
- IdenTrust Services, LLC — Preliminary incident report disclosed detailing the issue with test certificates.
- IdenTrust Services, LLC — Full incident report submitted with a summary of the incident and remediation actions.
- IdenTrust Services, LLC — Closure summary provided, confirming all action items have been completed.
Participants
IdenTrust Services, LLC
HARICA
Community commenter
Apple representative
CCADB representative
External References
Similar Local Cases
IdenTrust: Unauthorized OCSP responses for cross-signed roots
IdenTrust: Cross-signed root certificate mis-issuance
IdenTrust: Root OCSP Signer certificate mis-issuance
IdenTrust: Delay in updating a Bug 2014609 - Next update
IdenTrust: Delay in updating a Bugzilla ticket Bug 2014610 - Next update
IdenTrust: Full Incident Report for Bug 2014609 was not published within 14 days of discovering the issue
IdenTrust: ICA with invalid CDP
Identrust: Root CrossSign, of dedicated Roots, missing EKU