IdenTrust self-reported TLS CP/CPS non-compliance involving extra certificate policy OIDs; closure pending
IdenTrust Services, LLC self-reported a TLS certificate compliance issue discovered during an internal review of its TrustID TLS CP/CPS. The issue was that 42,858 TLS end-entity certificates were issued with certificatePolicies asserting both CA/B Forum and IdenTrust certificate policy identifiers, even though IdenTrust’s TLS CP/CPS had a deadline to stop including the IdenTrust policy IDs. IdenTrust said the certificates were non-compliant with its CP/CPS when issued, but that there were no security concerns with the issued certificates. It paused issuance, completed revocation of all impacted certificates by 2026-06-20, and later updated the TLS CP/CPS to remove the self-imposed deadline. In the latest thread activity, IdenTrust said all action items were complete and requested closure, and CCADB posted a final call for comments before expected closure around 2026-08-03.
- IdenTrust discovered that 42,858 TLS end-entity certificates had been issued with extra IdenTrust certificate policy OIDs contrary to its CP/CPS deadline.
- IdenTrust paused issuance and then resumed after remediation.
- IdenTrust completed revocation of all impacted certificates.
- IdenTrust reported that its TLS CP/CPS had been updated and requested closure.
- IdenTrust Services, LLC — IdenTrust filed a preliminary incident report describing the CP/CPS non-compliance and said impacted certificates would be revoked within 5 days.
- IdenTrust Services, LLC — IdenTrust said the full incident report would be posted by 2026-06-30.
- IdenTrust Services, LLC — IdenTrust posted the full incident report stating 42,858 certificates were non-compliant and had been revoked by 2026-06-20.
- IdenTrust Services, LLC — IdenTrust said one preventive action item was still in progress, with a due date of 2026-07-10.
- IdenTrust Services, LLC — IdenTrust marked the remaining action item complete.
- IdenTrust Services, LLC — IdenTrust posted a closure summary saying the TLS CP/CPS was updated, revocation was complete, process improvements were applied, and closure was requested.
- CCADB representative — CCADB posted a final call for comments or questions and said the incident report would be closed around 2026-08-03.