Cybertrust Japan: CRL signature algorithm encoding error (ECDSA parameters mismatch)

CRL Watch reported that two of Cybertrust Japan’s CRLs had a mismatch between the inner and outer AlgorithmIdentifier encodings for ECDSA with SHA-384: the inner AlgorithmIdentifier had no parameters while the outer AlgorithmIdentifier included parameters specifying the named curve "secp384r1". Mozilla requested that Cybertrust Japan file an incident report. Cybertrust Japan stated that Ben Wilson notified them of the CRL Watch errors and that they investigated the issue, confirmed the cause related to the required AlgorithmIdentifier encoding, and developed a patch. Cybertrust Japan reported that it received approval of its remediation plan from its PA and then remediated the CRLs, publishing corrected CRLs on 2023-04-11 15:37 JST and confirming the errors were removed from CRL Watch. The CA also stated it had not issued subscriber certificates yet under the affected CAs. The bug is marked RESOLVED with resolution FIXED, and Mozilla indicated it intended to close the bug after monitoring showed no further incidents.

1. 2023-04-05 CRL Watch reported encoding errors in two Cybertrust Japan CRLs involving mismatched inner/outer ECDSA signature AlgorithmIdentifier parameters.
2. 2023-04-11 Cybertrust Japan published remediated CRLs with corrected signature algorithm encoding and confirmed the errors were removed from CRL Watch.

1. 2023-04-11 Mozilla representative — Explained that the outer AlgorithmIdentifier parameters were non-compliant and stated the CRLs were fixed, requesting Cybertrust Japan file an incident report.
2. 2023-04-12 Cybertrust Japan / JCSI — Provided the incident report describing how they became aware via CRL Watch, their investigation timeline, remediation steps, and that remediated CRLs were published and errors removed from CRL Watch.
3. 2023-04-18 Cybertrust Japan / JCSI — Stated they were monitoring the bug.
4. 2023-04-26 Cybertrust Japan / JCSI — Commented on behalf of Masahiro that they were monitoring the bug.
5. 2023-05-02 Cybertrust Japan / JCSI — Stated they were monitoring the bug.
6. 2023-05-09 Cybertrust Japan / JCSI — Stated they were monitoring the bug.
7. 2023-05-16 Cybertrust Japan / JCSI — Stated they were monitoring the bug.
8. 2023-05-22 Cybertrust Japan / JCSI — Stated they were monitoring the bug.
9. 2023-05-29 Cybertrust Japan / JCSI — Stated they were monitoring the bug.
10. 2023-05-30 Mozilla representative — Said they had not noticed further incidents while monitoring CRL Watch and intended to close the bug around 2-June-2023.