Izenpe: Subordinate CA revocation entry omitted required reasonCode in root ARL
This case concerns Izenpe’s root ARL entry for a revoked Subordinate CA certificate that omitted the CRL entry extension `reasonCode`. The issue was first raised by a third party via email to Izenpe, and Izenpe initially investigated the wrong certificate before identifying the relevant SubCA revocation. Izenpe later confirmed that the certificate was revoked on 2023-11-21 and that the ARL entry did not include `reasonCode`, which it said appeared to be a potential compliance issue under CA/B Forum Baseline Requirements section 7.2.2. In the final incident report, Izenpe stated that the omission was due to its revocation processing for unspecified revocations and that it had initiated incident tracking and remediation. The bug remains assigned, and the thread includes action items to update PKI software and the CP/CPS.
- A Subordinate CA certificate was revoked on the Izenpe Root ARL with an unspecified reasonCode, so the extension was omitted.
- A community member notified Izenpe about non-compliance involving SubCA revocations without the `reasonCode` extension.
- Izenpe verified the finding and initiated incident tracking and remediation.
- Izenpe S.A. — Izenpe filed a preliminary incident report saying a revoked certificate in the latest root ARL lacked `reasonCode` and that the issue was reported to them by email.
- Community commenter — The reporter clarified that the CPR concerned six CA certificates and said the OCSP responder certificate was not the subject of the report.
- Izenpe S.A. — Izenpe said it had identified another relevant certificate revoked on 2023-11-21 and would update the bug report after further investigation.
- Izenpe S.A. — Izenpe posted a full incident report stating the ARL entry for a Subordinate CA omitted the mandatory `reasonCode` extension and listing remediation actions.