iTrusChina self-reports CP/CPS inconsistency and TLS certificate misissuance involving clientAuth
iTrusChina opened this bug to disclose a compliance incident after a third-party email on 2026-08-02 pointed out a contradiction in Section 7.1.2 of its CP/CPS. The company said the inconsistency affected the EKU description for precertificates versus subscriber certificates and was a violation of TLS BR Section 7.1.2.9. It also found that it had continued issuing TLS certificates with clientAuth and serverAuth after its CP/CPS update on 2025-09-19 allowed only serverAuth in subscriber certificates. iTrusChina said it stopped new issuance, updated the certificate profiles and CP/CPS, and revoked all misissued certificates within five days. In its closure summary on 2026-09-18, iTrusChina said the action items were complete and requested closure; CCADB then issued a final call for comments or questions and said the bug would be closed around 2026-09-25.
- iTrusChina updated its CP/CPS to allow only serverAuth certificates.
- iTrusChina received a third-party CPR about a CP/CPS EKU inconsistency.
- iTrusChina confirmed the CP/CPS inconsistency and the continued issuance of clientAuth and serverAuth TLS certificates.
- iTrusChina revoked all misissued certificates within five days.
- iTrusChina requested closure after stating all action items were complete.
- iTrusChina Co., Ltd. — iTrusChina filed a preliminary incident report describing the CP/CPS inconsistency, the misissuance, the stop on new issuance, and the plan to revoke within five days.
- iTrusChina Co., Ltd. — iTrusChina posted the full incident report with impact, timeline, remediation steps, and confirmation that all misissuances were revoked.
- iTrusChina Co., Ltd. — iTrusChina said it was monitoring the bug and that all action items had been completed.
- iTrusChina Co., Ltd. — iTrusChina again said all action items had been finished.
- iTrusChina Co., Ltd. — iTrusChina filed a closure summary stating the inconsistencies were corrected, remediation was complete, and closure was requested.
- CCADB representative — CCADB issued a final call for comments or questions and said the bug would be closed around 2026-09-25.