← Google Trust Services LLC cases
Bugzilla #1581183
Certificate Problem Report
Google Trust Services: CRL handling of expired certificates not fully compliant with RFC 5280 Section 3.3
RESOLVED
FIXED
Google Trust Services LLC
AI Summary
Google Trust Services identified a compliance issue with their Certificate Revocation List (CRL) generation process, which failed to include entries for expired certificates, violating RFC 5280 Section 3.3. The issue was discovered during an internal review on August 16, 2019, and was promptly addressed with a series of remediation steps. The affected software was patched to ensure expired certificates are included in CRLs for seven days post-expiration. The problem was fully resolved by September 2, 2019, with no significant client impact reported.
Chronology
- CRL generation issue discovered during internal review.
- Full remediation of the issue completed globally.
Participants
Wayne Thayer
Andy Warner
External References
Similar Local Cases
Google Trust Services: Forbidden Domain Validation Method 3.2.2.4.10
Google Trust Services: Incorrect revocation data temporarily served for GTS Y3 & Y4
Google Trust Services: Invalid OCSP responses
Google Trust Services: OCSP serving issue 2020-04-09
Google Trust Services: Invalid ASN.1 encoding of singleExtensions in OCSP responses
Google Trust Services: Improper OCSP response for intermediate certificate
DigiCert: Undisclosed CAs -Federated Trust CA-1
Google Trust Services: Failure to respond to CPR within 24 hours