Certainly: Serving invalid or incomplete CRLs

Certainly LLC reported an incident involving their Certificate Revocation List (CRL) service, which began serving invalid or incomplete CRLs on May 24, 2024. The issue was caused by a configuration error during a software update, leading to the mixing of R1 and E1 CRLs. This resulted in some requests for E1 CRLs receiving R1 CRLs instead, and the R1 CRLs not being updated with the latest revocations. The problem was discovered on May 29, 2024, and was corrected shortly thereafter. The CA has since implemented changes to their systems and monitoring processes to prevent similar issues in the future. The case is now resolved with all action items completed.

1. 2024-05-24 CRL service began serving invalid or incomplete CRLs due to a configuration error.
2. 2024-05-29 The issue was discovered and corrected.
3. 2024-06-06 All action items related to the incident were completed.

1. 2024-05-31 Fastly representative — Incident report detailing the CRL issue and its impact was submitted.
2. 2024-06-07 Fastly representative — Discussion on improving CRL monitoring tools to prevent future issues.
3. 2024-06-14 Fastly representative — All action items are complete, and monitoring for feedback continues.
4. 2024-06-22 Mozilla representative — Intention to close the bug unless further questions arise.