Actalis: CRL distribution point with ldap scheme

Actalis discovered that it had issued 28 TLS certificates containing an ldap-scheme URL in their CRLDistributionPoints extension, which is non-compliant with the CA/Browser Forum Baseline Requirements v2.0. Upon identifying the issue during routine checks, Actalis promptly revoked all affected certificates within the required timeframe. They also corrected the configuration of the affected SubCA to prevent future misissuances and developed additional linting mechanisms to enhance compliance checks. A full incident report was provided, detailing the root causes and remediation steps taken.

1. 2024-07-08 Actalis discovered ldap-scheme URLs in CRLDistributionPoints of some TLS certificates.
2. 2024-07-12 All affected certificates were revoked.
3. 2025-01-31 Actalis submitted a closure summary for the incident.

1. 2024-07-08 Staff representative — Actalis found some TLS certificates with a defect in their CRLDistributionPoints extension and will revoke them within 5 days.
2. 2024-07-12 Staff representative — All affected certificates were revoked.
3. 2024-07-18 Staff representative — Incident report detailing the issue and remediation steps was provided.
4. 2025-01-31 Staff representative — Submitted closure summary for the incident.