D-Trust S/MIME pre-sign linting incident: action items #2 and #3 completed, others still open
D-Trust self-reported that it had issued S/MIME certificates in violation of Section 4.3.1.2 of the S/MIME Baseline Requirements because required pre-sign linting was not implemented for specific S/MIME issuing CAs. The issue was identified internally on 2026-05-04, issuance from the affected part of the PKI was stopped the same day, and issuance was migrated to compliant infrastructure. D-Trust reported that all certificates still valid at the time were revoked by 2026-05-08 22:02 UTC. The bug has continued to track follow-up action items after the incident report was filed. In the latest update on 2026-08-28, D-Trust said Action Items #2 and #3 were complete, while Action Items #1, #4, and #5 remained open. D-Trust requested that the next update whiteboard field be set to 2026-09-30.
- Non-compliant S/MIME issuance began because required pre-sign linting was not implemented for the affected issuing CAs.
- D-Trust identified the missing pre-sign linting and stopped issuance from the affected part of its PKI.
- All remaining valid affected certificates were revoked.
- D-Trust reported that Action Items #2 and #3 were complete and that Action Items #1, #4, and #5 remained open.
- D-Trust — Posted a preliminary incident report describing the missing pre-sign linting, the stop to issuance, and the plan to revoke affected certificates.
- D-Trust — Confirmed that all revocations were completed within the required timelines and said root cause analysis and follow-up action items would follow.
- Bdr representative — Posted the full incident report with the non-compliance period, affected certificate count, affected issuing CAs, and completion of revocation.
- CCADB representative — Noted that the report had gone stale and reminded the CA owner about the Next update whiteboard field.
- D-Trust — Requested that the Next update whiteboard field be set to 2026-07-31 and listed the status of open action items.
- D-Trust — Reported that Action Item #4 was still ongoing and under audit.
- D-Trust — Said there was nothing new to report and that D-Trust continued working on the action items.
- D-Trust — Repeated that there was nothing new to report and that the action items were still ongoing.
- D-Trust — Said the agreed action items were still being implemented and that an update would follow once all actions were completed.
- D-Trust — Reported completion of Action Items #2 and #3, said Action Items #1, #4, and #5 remained open, and requested the next update whiteboard field be set to 2026-09-30.