← iTrusChina Co., Ltd. cases
Bugzilla #1907949
Ca Certificate Compliance
iTrusChina: CRL Reason Codes
RESOLVED
FIXED
iTrusChina Co., Ltd.
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
iTrusChina discovered that two revoked certificates were listed in their Certificate Revocation List (CRL) with an undefined reason code (7), which violates TLS Baseline Requirements and RFC 5280. Upon notification from Mozilla, iTrusChina initiated an investigation and confirmed the issue stemmed from system bugs that allowed incorrect revocation reasons. They have since corrected the CRL reason codes to 'unspecified' and implemented measures to prevent future occurrences, including restricting subscriber input for revocation reasons and establishing a daily monitoring task for compliance. The case has been resolved with all action items completed.
Chronology
- iTrusChina was notified of incorrect CRL reason codes for two revoked certificates.
- iTrusChina completed all remediation action items related to the incident.
Thread Activity
- Mozilla representative — Identified two revoked certificates with an undefined CRL reason code.
- iTrusChina Co., Ltd. — Acknowledged the issue and began an investigation.
- iTrusChina Co., Ltd. — Provided an incident report detailing the causes and impacts.
- iTrusChina Co., Ltd. — Confirmed completion of all action items to address the incident.
- Mozilla representative — Requested further details on preventative measures and compliance monitoring.
Participants
Mozilla representative
iTrusChina Co., Ltd.
External References
Similar Local Cases
iTrusChina: Finding in Routine WebTrust Audit - Domain validation records without the TLS BR version
iTrusChina: verification errors for the roots' CRLs(ARL)
TWCA: Policy OID not set to indicate the assurance level to the issued certs
Firmaprofesional: 2021 Audit Report Finding 2 out of 3
Disig: Non-BR-Compliant Certificate Issuance
NETLOCK: Policy Qualifiers other than id-qt-cps is included in TLS certificates
Hongkong Post: TLS certificates with basicConstraints not marked as critical
Entrust: Incorrect Business Category Value Discovered in an EV SSL Certificate