2053948 - IdenTrust: Delayed disclosure of Intermediate CA in CCADB

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[IdenTrust]

Preliminary Incident Report

Summary

• Incident description: A Timestamping Intermediate CA was generated on 2026-06-11 but not disclosed in CCADB until 2026-07-07.
• Relevant policies: CCADB Policy Section 3.2
• Source of incident disclosure: Self Reported

Comment 1

[IdenTrust]

We are actively working on the full incident report and will have it posted no later than 7-21-2026

Comment 2

[IdenTrust]

Full Incident Report

Summary

• CA Owner CCADB unique ID: A013252
• Incident description: A Timestamping Intermediate CA certificate was issued on 2026-06-11 but was not disclosed in CCADB within CCADB Policy’s required timeframe “Disclosure MUST take place within 7 calendar days of issuance and before the subject CA represented in the certificate begins issuing publicly-trusted certificates”. We issued one Timestamp Authorty certificate from the Intermediate CA, on 6-12-2026. The Timestamping Intermediate CA was disclosed in CCADB on 2026-07-07 after an internal review of our CA list.
• Timeline summary:
  • Non-compliance start date: 2026-06-12
  • Non-compliance identified date: 2026-07-07
  • Non-compliance end date: 2026-07-07
• Relevant policies:
  • CCADB Policy Section 3.2
• Source of incident disclosure: Self-Reported

Impact

• Total number of certificates: 1 Intermediate CA
• Total number of "remaining valid" certificates: 1 Intermediate CA
• Affected certificate types: Timestamp Issuing CA certificate
• Incident heuristic: The impacted certificate is listed in the appendix.
• Was issuance stopped in response to this incident, and why or why not?: No. Issuance was not stopped since the issue involved a CCADB disclosure delay.
• Analysis: N/A
• Additional considerations: None

Timeline (UTC)

• 2026-06-11 20:18:40 – Timestamp ICA certificate is issued
• 2026-06-12 19:26:49 – Timestamp Authority certificate issued
• 2026-06-18 – Timestamp ICA not disclosed to CCADB
• 2026-07-07– Internal review discovers undisclosed Timestamp CA certificate
• 2026-07-07 – Timestamp ICA certificate disclosed to CCADB

Related Incidents

Bug	Date	Description
2049960	2026-06-24	Actalis: Undisclosed Subordinate CA Certificate
1904041	2025-07-01	NETLOCK: Intermediate CA Certificate not disclosed to CCADB
1965559	2025-05-09	eMudhra: Delayed Publication of Issuing CA Certificates In CCADB

Root Cause Analysis

Contributing Factor #1: Absence of a verification step to confirm workflow completion for newly created Timestamp ICAs

• Description: The publication of Timestamp ICA certificates to CCADB is a multistep manual process. In this case the CCADB disclosure step was not executed because the executor missed it while updating additional CCADB entries. This manual process lacked a secondary verification approval checkpoint to confirm all steps were completed. Additionally, there was no automatic alert to notify the team that a step had not been completed before the deadline, to allow this misstep to be addressed in time.
• Timeline: 2026-06-11 to 2026-06-18
• Detection: An internal review of CCADB entries noted the missing ICA entry.
• Interaction with other factors: N/A
• Root Cause Analysis methodology used: 5-Whys

Lessons Learned

• What went well:
  The internal investigation and CCADB disclosure was addressed within 24 hours, upon discovery.
• What didn’t go well:
  • Reliance on manual workflow allowed human error.
  • Disclosure deadline was not tracked with automated team reminders.
• Where we got lucky: - The issue was discovered during internal review.

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Update undisclosed ICA in CCADB	Mitigate	Root Cause # 1	ICA in CCADB	07-07-2026	Complete
Implement improved new ICA workflow with automatic notifications	Prevent	Root Cause # 1	Notifications are received	09-18-2026	Ongoing

Appendix

Field	Value
Precertificate SHA-256 hash	N/A
Certificate SHA-256 hash	33543A2CB830CC879EC1FE9270607E329FF9AE120BA9D8FC2CDB5BFAFBD641B3
Subject	CN=TrustID Timestamping CA 6; O=IdenTrust; C=US
Issuer	CN=IdenTrust Public Sector Root CA 1; O=IdenTrust; C=US
Not before	2026-06-11T20:18:40Z
Not after	2032-06-09T20:18:39Z
Serial #	40019EB8563D5E56DA4CC2B22F319CA9
dNSNames	TrustID Timestamping CA 6
Is revoked?	No
Revocation date	N/A
Revocation reason	N/A

Comment 3

[IdenTrust]

We are working on our open Action Item. We request the Next Update field be set to 2026-09-18.

Comment 4

[IdenTrust]

The following action items are complete.

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Implement improved new ICA workflow with automatic notifications	Prevent	Root Cause # 1	Notifications are received	09-18-2026	Complete

Comment 5

[IdenTrust]

Report Closure Summary

• Incident description:
  A Timestamping Intermediate CA certificate was issued on 2026-06-11 but was not disclosed in CCADB within CCADB Policy’s required timeframe. The Timestamping Intermediate CA was disclosed in CCADB on 2026-07-07 after an internal review of our CA list.
• Incident Root Cause(s):
  Absence of a verification step to confirm workflow completion for newly created Timestamp ICAs with no automatic alert to notify the team about upcoming deadlines.
• Remediation description:
  The undisclosed ICA was added into CCADB and improved ICA workflow with automatic notifications was implemented.
• Commitment summary:
  No ongoing commitments remain beyond the Action Items completed in this report.

All Action Items disclosed in this report have been completed as described, and we request its closure.

Comment 6

[incident-reporting]

This is a final call for comments or questions on this Incident Report.

Otherwise, it will be closed on approximately 2026-10-01.