PKI news · Sources checked November 8, 2026
D-Trust reports that it revoked 858 Extended Validation (EV) TLS certificates after finding that issued certificates lacked subject fields promised in its Certification Practice Statement (CPS). For an affected site operator, the immediate task is to verify the replacement actually served to clients, rather than stop at a successful certificate order.
What changed
The completion update posted November 7 at 21:36 UTC says revocation finished on November 6 at 17:22:56 UTC, before the reported five-day deadline. Of 866 affected certificates, eight had already expired or been revoked. D-Trust says certificate revocation lists (CRLs) and its online status service (OCSP) subsequently confirmed all 858 revocations. We have not independently repeated those checks.
The preliminary report describes missing localityName, streetAddress and postalCode attributes required by CSM CPS version 5.5, section 3.1.4. D-Trust discovered the discrepancy and stopped EV issuance on November 2. The affected issuers are D-TRUST EV CA 1-20-1 2020 and D-TRUST EV CA 2-23-1 2023.
A replacement is a deployment task
The following is an operational checklist, not a report of additional failures at D-Trust or its customers. Start with your own inventory and the provider’s case-specific guidance.
- Identify the certificate precisely. Record the issuer and serial number, SHA-256 fingerprint, expiry date and responsible service owner. An issuer name alone does not establish that a particular certificate is affected.
- Map every place it is served. Include load balancers, reverse proxies, CDN configurations and standby endpoints. Check the relevant hostname and TLS termination point; an application server’s local certificate file may not be the one clients receive.
- Verify the deployed replacement. Compare the certificate presented by each endpoint with the intended replacement. Check its hostname coverage, validity and chain using the clients your service supports. Keep normal certificate verification enabled.
- Record the result and remaining gaps. Capture the tested endpoint, time, observed fingerprint and outcome. Escalate an endpoint still serving the old certificate. Treat an unreachable endpoint as an unresolved check, not a pass.
A successful page load is a useful service check, but it does not document that every endpoint has switched. Close the deployment only when the intended scope is accounted for, including any approved exceptions and their owners.
What remains open
D-Trust says the full incident report, including certificate lists, will follow by November 16. The current update confirms reported revocation completion; it does not supply the full root-cause analysis or establish customer deployment status.
CCADB’s reporting guidance expects clear causes and measurable corrective actions. Those are the useful follow-up questions: which control missed the CPS discrepancy, what will detect it earlier, and what evidence shows the change works?