DigiCert / ADACOM: published expired CRLs
The case concerns ADACOM CRLs that were published in a way that caused four intermediate certificates that should have been revoked to be missing from ADACOM’s CRLs. The issue was triggered when DigiCert notified ADACOM that the four revoked intermediate certificates were not present in the CRLs at the referenced CRL URLs. After DigiCert contacted ADACOM, ADACOM replaced the CRLs with versions containing the missing revocation entries. The thread explains that ADACOM had manually replaced the CRLs with newly generated versions, but on 30-Jul-18 the CRL files were automatically reverted back to earlier versions due to a server failover/synchronization problem, effectively “unrevoking” the intermediates until the issue was corrected. ADACOM stated it would modify its CRL publication process to add synchronization checks, manual verification that new CRLs are replaced on all public web servers, and removal of outdated CRL files from its publication list. In a later comment, ADACOM confirmed it implemented monitoring alerts for CA synchronization status and added review of CRL postings to ensure the correct CRL is in place, and noted the incident had no impact to third parties or services because the affected certificates had expired before the revocation date. The bug is marked RESOLVED with resolution FIXED.
- ADACOM received new CRLs from DigiCert and manually replaced the published CRL files with versions containing the missing revoked intermediate entries.
- A server halt/failover caused CRL synchronization to fail, and older CRL files were re-published.
- ADACOM was informed that the CRLs had reverted to previous versions and restored the CRL files to the most current versions.
- Community commenter — Reported that four intermediates that should have been revoked were not present in ADACOM’s CRLs and that DigiCert contacted ADACOM, after which the CRLs were replaced with versions containing the missing entries; requested an incident report and linked the Mozilla incident-report instructions.
- Community commenter — Provided the issue notice details (including the four missing revoked intermediates and CRL URLs), described the timeline and explanation for the CRL reversion, and listed remediation steps to prevent recurrence.
- Community commenter — Asked Ben to confirm that ADACOM implemented all proposed remediations.
- Community commenter — Confirmed ADACOM implemented monitoring alerts for synchronization status and reviews of CRL postings, and stated the incident had no impact to third parties or services because affected certificates had expired before the revocation date.