Sectigo: Temporary unavailability for subset of CRLs
Sectigo reported an incident where, after a change to infrastructure during decommissioning of a deprecated CRL distribution system, 13 CRLs became unavailable and returned HTTP 504 Gateway Time-out errors. The issue occurred between 18:44 and approximately 19:53 UTC on 2024-07-16, affecting CRL responses rather than serving the expected CRL content. Sectigo stated the change ceased use of the deprecated CRL publishing system, and that the affected CRL hostnames were still routed directly to the deprecated system instead of through their CDN. Sectigo investigated and reversed the earlier change, restoring availability of the affected CRLs. The thread records completed action items, including reviewing and adjusting policies for deprecation of legacy systems, reviewing DNS settings for OCSP/CRT/CRL service domains, and switching off the deprecated CRL distribution platform only after confirming it was no longer receiving requests. The bug was requested for closure after all action items were completed and no questions were raised, and Mozilla indicated it would be closed on 23-Aug-2024. The bug status is RESOLVED with resolution FIXED.
- Sectigo’s infrastructure change during deprecated CRL system decommissioning caused 13 CRLs to return 504 errors until the change was reversed.
- Sectigo — Opened an incident report describing the 2024-07-16 CRL unavailability (504 errors) and the cause and remediation, and listed action items.
- Sectigo — Requested a next update for 2024-08-15 based on the action items.
- Sectigo — Reported both initial action items as completed and added a third action item to confirm the deprecated CRL platform was no longer receiving requests.
- Sectigo — Requested closing the bug after all action items were completed and no questions were raised.
- Mozilla representative — Confirmed intent to close the bug on Friday, 23-Aug-2024.