D-Trust follow-up on TLS issuance linting incident and completion of policy-document publication
D-Trust self-reported a TLS issuance compliance incident after concluding that its RA-side and CA-side pre-sign checks did not meet the required linting standard in TLS Baseline Requirements Section 4.3.1.2. The incident covered 57,565 TLS certificates issued between 2025-03-15 and 2026-04-02, and D-Trust said it stopped issuance from the affected part of its PKI on 2026-04-02 before resuming after deploying a compliant pre-sign linting solution. D-Trust reported that all affected certificates were revoked by 2026-04-07. The thread then shifted to follow-up work on reviewing applicable requirements and updating public policy documents. D-Trust said the systematic review was completed, identified about 130 documentation gaps, and later published revised CP, CPS, and TSPS documents effective 2026-10-16. On 2026-10-19 D-Trust marked the action item complete, and on 2026-10-22 it said it was still addressing questions raised about the review evidence.
- D-Trust continued issuing TLS certificates after the mandatory pre-sign linting requirement in Section 4.3.1.2 took effect.
- D-Trust stopped issuance from the affected part of its PKI and later resumed after deploying a compliant pre-sign linting solution.
- D-Trust completed revocation of all affected TLS certificates.
- D-Trust completed a systematic review of applicable requirements and controls and identified about 130 documentation gaps.
- D-Trust published revised policy documents and marked the action item complete.
- Bdr representative — D-Trust filed a preliminary incident report saying its internal checks did not satisfy the linting requirement and that it had stopped issuance pending remediation.
- Bdr representative — D-Trust confirmed that all affected TLS certificates had been revoked.
- Bdr representative — D-Trust said it had conducted mass revocation exercises on 2026-03-03 and 2026-03-24, with the latter performed as part of an independent third-party audit.
- Bdr representative — D-Trust posted a full incident report stating that 57,565 certificates were issued in violation of Section 4.3.1.2 and that the affected certificates had been revoked.
- Mozilla representative — Mozilla explained that CA revocation obligations and browser revocation enforcement are separate responsibilities.
- Bdr representative — D-Trust said there was nothing new to report and requested the next update deadline be set for 2026-08-29.
- D-Trust — D-Trust said the remaining action item was ongoing, the due date of 2026-09-30 was unchanged, and requested the next update date be set to 2026-09-30.
- D-Trust — D-Trust said its systematic requirements review was complete, no inconsistencies were found, and approximately 130 requirement-to-control mappings lacked sufficient specificity in public documents.
- D-Trust — D-Trust said the planned publication date for revised public documents was missed and requested the next update date be set to 2026-10-20.
- D-Trust — D-Trust said the revised public documents were now available and effective, and that the action item was complete.
- D-Trust — D-Trust said it was currently addressing questions raised about the review evidence.