Amazon Trust Services / DigiCert: 404 error when fetching CRL
The bug concerns a 404 Not Found error when fetching a specific CRL URL referenced in CCADB for an ICA operated by DigiCert (Amazon ECDSA 256 M01). Amazon disclosed a JSON array of partitioned CRLs, but accessing the second referenced URL returned 404. In response, Amazon Trust Services (ATS) acknowledged the issue and corrected CCADB by removing the referenced URL. ATS stated the URL was associated with the ICA but never ended up being used and had been disabled. ATS also explained that CCADB limitations prevented updating the ICA field directly, so ATS would perform the update on their behalf. ATS further reported that it audited the CRL entries in CCADB, removed unused URLs, and described how the issue arose during configuration and CRL disclosure timing around browser requirements. The bug was requested to be resolved as FIXED and was closed by Mozilla as RESOLVED/FIXED.
- A referenced CRL URL for an ICA in CCADB returned 404 Not Found when fetched.
- ATS corrected CCADB by removing the referenced CRL URL that was never used.
- ATS provided an audit and remediation explanation, including removal of unused CRL URLs and verification before issuance.
- ATS requested the bug be resolved as FIXED; Mozilla indicated it would close it on or about 2-Dec-2022.
- Mm representative — Reported that one of the disclosed CRL URLs for the Amazon ECDSA 256 M01 ICA returned a 404 Not Found error when fetched.
- DigiCert — Acknowledged the bug and said ATS corrected CCADB to remove the referenced URL; noted CCADB limitations required ATS to perform the update on their behalf.
- DigiCert — Provided a detailed response describing how the CRL URLs were staged during ICA setup and why unused URLs were not removed, and stated remediation steps including removing unused URLs and verifying CCADB entries before issuance.
- DigiCert — Requested the bug be resolved as Fixed if there were no further questions.
- Mozilla representative — Indicated Mozilla would close the bug on or about Friday 2-Dec-2022 unless further issues remained.