Telekom Security: CRL also contained unrevoked certificates

Deutsche Telekom Security GmbH reported an incident where a Certificate Revocation List (CRL) incorrectly included unrevoked certificates due to a software bug during a maintenance change. The CA became aware of the issue on July 23, 2020, and took immediate action to rectify the situation, including issuing a new CRL and fixing the erroneous database entries. Although no certificates were misissued, the incident raised concerns about the potential for unrevocation and compatibility issues. The CA committed to revoking the affected certificates after allowing customers time to transition. Ultimately, all 907 affected certificates were revoked by October 1, 2020, and the CA has since implemented measures to prevent similar incidents in the future.

1. 2020-07-23 CA discovered that the CRL contained unrevoked certificates due to a software bug.
2. 2020-10-01 All affected certificates were revoked.

1. 2020-07-28 Telekom representative — Reported the incident and provided a detailed timeline of actions taken.
2. 2020-08-06 Telekom representative — Confirmed that the software bug was fixed and tested.
3. 2020-10-02 Telekom representative — Reported that the last of the affected certificates were revoked.
4. 2021-01-26 Telekom representative — Provided updates on technical measures to prevent future unrevocation.