IdenTrust self-reported TLS end-entity certificate mis-issuance involving extra certificate policy OIDs

IdenTrust reported an internal review finding a compliance issue in its TrustID TLS CP/CPS related to issuance of TLS end-entity certificates. The issue was that TLS certificates were issued with additional IdenTrust certificate policy OIDs, even though the CP/CPS had a scheduled date for removing inclusion of those certificate policy OIDs. After confirmation, IdenTrust halted issuance and then resumed issuance after remediation was completed. IdenTrust stated that all impacted certificates will be revoked within 5 days. The bug was opened as a self-reported preliminary incident report referencing TrustID TLS CP/CPS v5.0.3 sections 7.1.2.3 and 7.1.6.

1. 2026-06-18 IdenTrust self-disclosed a TrustID TLS CP/CPS compliance issue where TLS end-entity certificates were issued with additional certificate policy OIDs, then halted and later resumed issuance after remediation.

1. 2026-06-18 roots@identrust.com — Posted a preliminary incident report stating that an internal review found TLS end-entity certificates were issued with additional certificate policy OIDs contrary to a CP/CPS removal date; issuance was halted, remediation completed, issuance resumed, and impacted certificates would be revoked within 5 days.