Remediate

Remediation

The platform recommends changes and records progress. Engineers implement changes through the Bank's own change process; nothing is modified automatically.

OPEN13
ASSIGNED4
CHANGE PLANNED1
IMPLEMENTED0
RETEST REQUIRED0
VERIFIED0
CLOSED0
18
REM-104FND-1045CriticalCHANGE PLANNEDOBMIG-243

Keyfactor issuing CA absent from trust store

  1. OPEN→
  2. ASSIGNED→
  3. CHANGE PLANNED→
  4. IMPLEMENTED→
  5. RETEST REQUIRED→
  6. VERIFIED→
  7. CLOSED
Current state

/etc/pki/ob-truststore.jks contains Entrust G2 root + issuing CA only

Required state

ob-dual-trust-2026 bundle (Entrust G2 + Keyfactor OB Root + Keyfactor OB Issuing CA)

Recommended change

Distribute the dual-trust bundle via the Trust Store Distribution Agent and verify with the Keyfactor chain test.

Affected systems
TPP Registration Service
Dependencies
Trust Store Distribution Agent; PKI Services sign-off
Risk
Critical
Suggested test
TST-007 Validating Keyfactor certificate
Evidence required
  • Configuration snapshot (post-change)
  • Test result with PASS
  • Engineer attestation
Ownership