iTrusChina: verification errors for the roots' CRLs(ARL)

RESOLVED FIXED iTrusChina Co., Ltd.

This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update. Always refer to the official Bugzilla thread as the authoritative source. If you spot an inaccuracy, let me know via the contact form.

AI Summary

iTrusChina Co., Ltd. reported a design bug in their offline CA's ARL system that led to verification errors for their root certificates' CRLs. The issue was first identified by Andrew Ayer on May 21, 2021, and iTrusChina acknowledged the problem on May 24, 2021. They halted certificate issuance during the troubleshooting process, which involved identifying and fixing the bug in the ARL signature process. The CA implemented a new feature to automatically verify the signatures of newly issued ARLs and CRLs. The issue was resolved, and the new version of the CA system was deployed on May 25, 2021.

Model: gpt-4o-mini Generated: 2026-06-13 21:11 UTC Revised: 2026-06-16 19:09 UTC Confidence: 0.85 28 comments

Chronology

2021-05-21 Issue reported by Andrew Ayer regarding verification errors.
2021-05-24 iTrusChina acknowledged the issue and began troubleshooting.
2021-05-25 New version of the CA system was deployed to resolve the issue.

Thread Activity

2021-05-25 iTrusChina Co., Ltd. — Reported a design bug causing signature verification failures.
2021-05-25 Community commenter — Inquired about the seriousness of the security issue.
2021-05-26 iTrusChina Co., Ltd. — Provided detailed steps of the ARL generation process.
2021-10-22 iTrusChina Co., Ltd. — Requested to resolve the bug as fixed after completing testing.

Participants

iTrusChina Co., Ltd. Community commenter Mozilla representative

External References

Original Bugzilla Case

Similar Local Cases

#2013805 RESOLVED Ca Certificate Compliance Opened 2026-02-02 · Closed 2026-05-01 · 87% similar

iTrusChina: Finding in Routine WebTrust Audit - Domain validation records without the TLS BR version

AI Summary CA Owner

#1907949 RESOLVED Ca Certificate Compliance Opened 2024-07-15 · Closed 2024-08-28 · 80% similar

iTrusChina: CRL Reason Codes

AI Summary CA Owner

#1624527 RESOLVED Ca Certificate Compliance Self Reported Incident Opened 2020-03-24 · Closed 2023-02-22 · 79% similar

DigiCert: Issuance of Cert with Compromised Key

AI Summary CA Owner

#1593776 RESOLVED Ca Certificate Compliance Incident Opened 2019-11-04 · Closed 2023-02-22 · 77% similar

Sectigo: invalid subject:organizationalUnitName on DV certificates

AI Summary CA Owner

#1680378 RESOLVED Ca Certificate Compliance Self Reported Incident Opened 2020-12-02 · Closed 2023-02-22 · 77% similar

NetLock: Replacement of enduser certificates after the EVGL 1.7.4 self-audit

AI Summary CA Owner

#1718991 RESOLVED Ca Certificate Compliance Certificate Misissuance Opened 2021-07-02 · Closed 2024-05-09 · 77% similar

Microsoft PKI Services: Malformed ICAs (Key Usage Malformed)

AI Summary CA Owner

#1716123 RESOLVED Ca Certificate Compliance Certificate Misissuance Self Reported Incident Opened 2021-06-12 · Closed 2024-05-25 · 77% similar

e-commerce monitoring GmbH: CN domain not in SAN

AI Summary CA Owner

#1610303 RESOLVED Ca Certificate Compliance Opened 2020-01-20 · Closed 2023-02-22 · 77% similar

D-TRUST: Issuance of non-conformant SSL certificate

AI Summary CA Owner