2065616 - IdenTrust: Expired certificates for "Revoked" test websites

Status: ASSIGNED

(CA Program :: CA Certificate Compliance, task)

Description

[IdenTrust]

Preliminary Incident Report

Summary

• Incident description: On 2026-08-20 IdenTrust’s revoked TLS certificates on the test websites had expired and were not renewed. These certificates have been replaced, revoked, and are on the test websites.
• Relevant policies: TLS BRs Section 2.2 Publication of information
• Source of incident disclosure: Self-reported

Comment 1

[IdenTrust]

Full Incident Report

Summary

• CA Owner CCADB unique ID: A000036
• Incident description: On 2026-08-20 IdenTrust’s nine Revoked TLS test website certificates had expired and were not replaced. The Revoked test websites presented expired certificates to visitors for over 9 hours. These test website certificates have been issued, revoked, and are on the test websites.
• Timeline summary: (All times in UTC)
  • Non-compliance start date: 2026-08-20 06:00:18
  • Non-compliance identified date: 2026-08-20 15:05
  • Non-compliance end date: 2026-08-20 15:16:41
• Relevant policies: TLS BRs Section 2.2
• Source of incident disclosure: Self-reported

Impact

• Total number of certificates: 9
• Total number of "remaining valid" certificates: 0
• Affected certificate types: DV, OV, and EV
• Incident heuristic: The full corpus of affected certificates are disclosed in the attachement.
• Was issuance stopped in response to this incident, and why or why not?: No, this impacted the TLS test websites only.
• Analysis: N/A
• Additional considerations:

Timeline

• 2026-08-09 06:12 – 10-day notification of Revoked test websites expiration
• 2026-08-14 06:21 – 5-day notification of Revoked test websites expiration
• 2026-08-17 17:01 – 3-day notification of Revoked test websites expiration
• 2026-08-18 16:02 – 2-day notification of Revoked test websites expiration
• 2026-08-18 16:05:44 – Valid test websites replaced while revoked test websites were not replaced
• 2026-08-20 06:00:18 – Revoked test website certificates expired
• 2026-08-20 15:05 – Non-compliance identified as part of regular monitoring
• 2026-08-20 15:16:41 – Revoked test website certificates replaced

Related Incidents

Bug	Date	Description
2061909	2026-08-07	Revoked test website certificates had expired
2052399	2026-07-02	Revoked test website certificates had expired
2025231	2026-03-22	Revoked test website certificate still valid
2025135	2026-03-21	Revoked test website certificate had expired
1979287	2025-07-25	Revoked test website certificate had expired
1883792	2024-03-05	Our previous issue with test website certificates

Root Cause Analysis

Contributing Factor #1: Failure of automated process

• Description: The issue stemmed from problems with the automated process for the test website certificates. The load balancer had a configuration change that caused a renewal failure within the test website process. The process for updating the test website certificates resulted in reliance on the manual process as the issue is being addressed.
• Timeline: 2026-05-22 Load balancer configuration change.
• Detection: Noticed renewal of test certificates was failing renewal during regular monitoring.
• Interaction with other factors:
• Root Cause Analysis methodology used: 5-Whys

Contributing Factor #2: Lack of details in manual process

• Description: The process to manually update the test website certificates provided general information. Notifications of expiring certificates for the test website certificates occurred in multiple locations to notify team members of the pending expiration. The person selected to address the expiring certificate notifications followed the steps in the manual process to validate the Valid test website certificates were operational, but did not understand the Revoked test website certificates needed to be addressed because the documented manual process did not have that detail.
• Timeline: 2025-08-27 Last date the manual process was updated.
• Detection: During investigation of this incident.
• Interaction with other factors:
• Root Cause Analysis methodology used: 5-Whys

Lessons Learned

• What went well:
• What didn’t go well: When the automated process was broken, the manual process was not reviewed to make sure it had sufficient details.
• Where we got lucky: The expired Revoked test website certificates were quickly identified.
• Additional:

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Replace and revoke Revoked test website certificates	Mitigate	Root Cause #2	Revoked certificates on the test websites are replaced	2026-08-20	Complete
Fix automation for test website certificates	Prevent	Root Cause #1	Automation fixed for test website certificates	2026-09-30	Ongoing
Provide more detail in manual renewal process for test website certificates	Prevent	Root Cause #2	Process is updated with clear details	2026-08-24	Complete

Appendix

See attachment

Comment 2

[IdenTrust]

Attachment: 2065616-impactedcerts.csv

Comment 3

[IdenTrust]

We are working on our open Action Item. We request the Next Update field be set to 2026-09-30

Comment 4

[IdenTrust]

A few final details are still being refined, and the remaining action item will be completed by 10/2.

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Fix automation for test website certificates	Prevent	Root Cause #1	Automation fixed for test website certificates	2026-10-02	Ongoing

Comment 5

[IdenTrust]

The last action item is complete.

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Fix automation for test website certificates	Prevent	Root Cause #1	Automation fixed for test website certificates	2026-10-02	Complete

Comment 6

[IdenTrust]

Report Closure Summary

• Incident description:
  IdenTrust’s nine Revoked TLS test website certificates had expired and were not replaced, presenting expired certificates to visitors for over 9 hours.
• Incident Root Cause(s):
  There was a failure in the automation process for the test website certificates. Therefore, we shifted to the manual process as the issue was being addressed. The documented manual process did not have clear enough details on the process for the Revoked test websites which caused them to not be replaced before expiration.
• Remediation description:
  The revoked certificates on the test websites were replaced, the automation for the test website certificates was fixed, and more details were added to the manual renewal process for the test website certificates.
• Commitment summary:
  No ongoing commitments remain beyond the Action Items completed in this report.

All Action Items disclosed in this report have been completed as described, and we request its closure.

Comment 7

[incident-reporting]

This is a final call for comments or questions on this Incident Report.

Otherwise, it will be closed on approximately 2026-10-17.