IdenTrust: Inaccurate CRL Details in CCADB

IdenTrust reported that CCADB contained inaccurate CRL details for multiple IdenTrust issuing CAs (ICAs) and an ISRG cross-signed root, as flagged by CRL Watch after notification from Andrew Ayer. The issue was that the CCADB field “Full CRL Issued by This CA” used CRL URLs that were not the correct ones (e.g., using the ICA CRL Distribution Point extension value rather than the leaf CRL Distribution extension, and using an incorrect CRL URL for the ISRG Root X1 cross-signed case). After receiving the notification, IdenTrust alerted internal teams and updated CCADB with corrected CRL URLs for the flagged ICAs within 48 hours. IdenTrust also investigated the remaining flagged ICA, confirmed it had been revoked, and coordinated with Andrew Ayer to remove it from the CRL Watch list as a false positive. For future prevention, IdenTrust improved its CCADB update process by requiring a second-person validation before entering updates and by logging updates internally for validation compliance. The thread indicates IdenTrust had no additional actions pending and requested closure, and Mozilla planned to close the bug unless further questions arose.

1. 2023-02-20 IdenTrust received notification that CRL Watch had flagged multiple IdenTrust issuing CAs with CCADB CRL discrepancies.
2. 2023-02-21 IdenTrust confirmed one remaining flagged ICA was revoked and began further investigation to resolve the discrepancy.
3. 2023-02-22 IdenTrust corrected the CCADB CRL entry for the ISRG Root X1 cross-signed case and confirmed it no longer appeared in CRL Watch.
4. 2023-03-10 IdenTrust requested closure stating there were no additional actions pending.

1. 2023-02-24 IdenTrust Services, LLC — IdenTrust described the CRL Watch notification, the incorrect CCADB CRL URL values, the corrective CCADB updates, and process changes (second-person validation and internal logging) to prevent recurrence.
2. 2023-03-10 IdenTrust Services, LLC — IdenTrust stated there were no additional actions pending and requested closure.
3. 2023-03-10 Mozilla representative — Mozilla indicated it would close the bug next Wednesday (15-Mar-2023) unless there were additional questions or issues.