D-Trust: EV TLS certificates missing subject attributes required by CSM CPS section 3.1.4
Categories
(CA Program :: CA Certificate Compliance, task)
Tracking
(Not tracked)
People
(Reporter: Frank.Meissen, Assigned: Frank.Meissen)
Details
(Whiteboard: [ca-compliance] [ev-misissuance])
Preliminary Incident Report
Summary
-
Incident description: On 2026-11-02 09:48 UTC a D-Trust employee discovered a discrepancy between the description of the naming attributes in Extended Validation (EV) certificates in its CSM CPS, version 5.5, chapter 3.1.4 and the current practice of certificate issuance: chapter 3.1.4 states that these certificates contain at least the subject attributes localityName, streetAddress and postalCode, which EV certificates issued by D-TRUST EV CA 1-20-1 2020 and D-TRUST EV CA 2-23-1 2023 do not contain. The discrepancy was confirmed at 2026-11-02 10:05 UTC. Issuance of EV certificates was stopped at 2026-11-02 11:35 UTC. Based on our current analysis, 866 certificates are affected. Affected certificates that are still valid will be revoked in accordance with TLS BR chapter 4.9.1.1.
-
Relevant policies: Certification Practice Statement of the D-Trust CSM PKI [CSM CPS], version 5.5, chapter 3.1.4; Extended Validation Guidelines [EVGL], chapter 7.1.4; TLS Baseline Requirements [TLS BR], chapter 4.9.1.1; Mozilla Root Store Policy [MRSP], chapter 5.2
-
Source of incident disclosure: Self Reported
|
||
Updated•11 days ago
|
|
Assignee | |
Comment 1•7 days ago
|
||
Revocation completed
All affected certificates that were still valid have been revoked.
- Revocation started: 2026-11-06 16:23:55 UTC
- Revocation completed: 2026-11-06 17:22:56 UTC
- CRLReason: superseded (4), as specified in TLS BR Section 4.9.1.1(12)
- Revocation deadline: D-Trust became aware of the issue on 2026-11-02 09:48 UTC. The five-day period under TLS BR Section 4.9.1.1 ended on 2026-11-07 09:48 UTC. All revocations were completed within this period.
The Preliminary Incident Report in comment 0 identified 866 affected certificates. When the mass revocation was prepared, 8 of them were no longer valid: they had expired or had already been revoked. The remaining 858 certificates were revoked:
| Issuing CA | Revoked certificates |
|---|---|
| D-TRUST EV CA 1-20-1 2020 | 32 |
| D-TRUST EV CA 2-23-1 2023 | 826 |
Verification: Before revocation, an OCSP check confirmed that all 858 certificates were known to the OCSP responder and not revoked. After revocation, all 858 revocations were found in the CRLs of the two issuing CAs, and the OCSP responder returned the status "revoked" for all 858 certificates.
The list of the 858 revoked certificates and of the 8 certificates that were no longer valid will be included in the Full Incident Report.
The Full Incident Report will follow no later than 2026-11-16.
Description
•