Identrust: Root cross-signs of dedicated roots missing required EKU at the root level
IdenTrust reported an incident involving recent root cross-signs of dedicated roots where the dedicated Root certificates were missing the required EKU presence for their respective chains. The issue was that issuing CAs underneath these dedicated roots asserted EKUs, but the EKU was additionally required at the Root level for cross-signing with multi-purpose roots. IdenTrust stated the non-compliance began on 2026-01-26, was identified on 2026-03-24, and ended on 2026-03-28. The incident was disclosed after a third party notified IdenTrust of the missing EKU on 2026-03-24, and IdenTrust submitted both a preliminary and a full incident report. IdenTrust revoked the affected cross-signed root certificates on 2026-03-28 and updated relevant certificate profiles to include the EKU(s). IdenTrust also added an issuance check for compliance with CCADB Policy Section 6.3, and reported that all action items were completed, requesting closure; the bug is marked RESOLVED with resolution FIXED.
- IdenTrust issued multiple cross-signed root certificates for dedicated roots without EKU assertion.
- IdenTrust was notified by a third party that the cross-signed root certificates were missing required EKU presence.
- IdenTrust revoked the affected cross-signed root certificates.
- Mozilla CA Program bug marked RESOLVED (FIXED).
- IdenTrust Services, LLC — Submitted a Preliminary Incident Report describing missing EKU presence on dedicated root cross-signs and citing CCADB Policy 6.3.
- IdenTrust Services, LLC — Announced a plan to publish the full incident report by the end of the week.
- IdenTrust Services, LLC — Submitted the Full Incident Report with timeline, impact (6 total certificates; 0 remaining valid), and root cause analysis.
- IdenTrust Services, LLC — Provided action items including updating certificate profiles to include EKU(s) and adding an issuance check for CCADB Policy 6.3 compliance.
- IdenTrust Services, LLC — Reported certificate profile updates as complete and continued investigating the issuance check, requesting a next-update field of 2026-04-30.
- IdenTrust Services, LLC — Reported the issuance check for missing EKUs in root cross-sign scenarios as implemented (complete).
- IdenTrust Services, LLC — Stated all action items were completed and that a closure report would be submitted by end of the week.
- IdenTrust Services, LLC — Submitted the Report Closure Summary, stating remediation (revocation, certprofile updates, issuance check) and requesting closure.
- CCADB representative — Issued a final call for comments or questions before closure on approximately 2026-05-18.