GlobalSign: CRL contains invalid signature algorithm
The bug reports that a GlobalSign CRL contained a signature algorithm that did not match the CA key type. The reporter noted that the CA uses an elliptic curve key, but the CRL signature algorithm was `sha256WithRSAEncryption`, and attached a copy of the CRL. GlobalSign acknowledged the issue and said it would review the signature algorithm configuration of the affected CRL, investigate, and provide an incident report by October 7, 2022. In its incident report, GlobalSign stated it became aware following the Bugzilla ticket and that it confirmed there were currently no active non-expired certificates issued from the affected CRL and that no other active CRLs were affected. GlobalSign explained the mistake as logic that determined the CRL signing algorithm OID based on the certificate of the CA signing the CRL, and said an exceptional ECC/RSA hierarchy combination was not covered by testing. GlobalSign updated the CRL signing algorithm logic to select the signing algorithm OID based on the issuer key, added test cases for ECC and RSA hierarchies, and stated the updated code was expected to be deployed in production by October 14, 2022. GlobalSign later confirmed the updated CRL logic was deployed and that the CRL is generated with the appropriate signing algorithm, and Mozilla indicated it intended to close the case around October 19, 2022.
- A Bugzilla ticket was filed reporting that a GlobalSign CRL had an invalid signature algorithm.
- GlobalSign deployed updated CRL signing logic and confirmed the CRL is generated with the appropriate signing algorithm.
- Community commenter — Created the bug and attached a copy of the CRL, stating the CRL used `sha256WithRSAEncryption` despite the CA using an elliptic curve key.
- GlobalSign nv-sa — Acknowledged the issue and said GlobalSign would review the CRL signature algorithm configuration, investigate, and provide an incident report by October 7, 2022.
- GlobalSign nv-sa — Provided an incident report describing how the wrong signing algorithm OID was included and the remediation steps planned (logic update and added test cases).
- GlobalSign nv-sa — Confirmed the updated CRL logic was deployed and that the CRL is generated with the appropriate signing algorithm, stating remedial activities were concluded.
- Mozilla representative — Stated an intention to close the case on or about 19-Oct-2022.