D-Trust: CRL-Entries without required CRL Reason Code
This case concerns D-Trust’s revocation of TLS certificates associated with Mozilla Bugzilla incident 1884714. The CA reported that, although the affected TLS certificates were revoked within the 5-day revocation period ending on 2024-03-15, the CRLs did not include the required CRL reason code (CRLReason #4, superseded) for certificates revoked by D-Trust. The CA stated this was not compliant with TLS BRs section 4.9.1.1 (Reasons for Revoking a Subscriber Certificate). In the final incident report, D-Trust attributed the issue to its mass revocation process: the internal revocation ticket contained the certificates to be revoked but did not include a revocation reason code, and the mass revocation interface did not require a CRLReason code. D-Trust reported that it had already introduced a new mass revocation interface where a CRLReason code is mandatory, and it also planned retraining and documentation updates for CRLReason Codes. The thread indicates that D-Trust completed the measures and requested closure, and Mozilla stated it would close the bug on 11-Sept-2024. The bug is resolved as FIXED.
- All affected TLS certificates from Bugzilla incident 1884714 were revoked, but the required CRL reason code was not used in the CRLs.
- D-Trust opened the Bugzilla incident ticket and informed the Conformity Assessment Body about the CRL reason code issue.
- D-Trust published the final incident report describing the root cause and corrective actions.
- Mozilla indicated it would close the bug on 11-Sept-2024 after D-Trust requested closure.
- Bdr representative — Opened a preliminary incident report stating that 2,601 TLS certificates were revoked on 15/03/2024 without CRL reason codes in the CRLs, which was reported as non-compliant with TLS BRs section 4.9.1.1.
- Bdr representative — Published a final incident report stating that no revoked TLS certificates contained the required CRLReason #4 and explaining the mass revocation ticket/interface root cause; also listed retraining and documentation updates as action items.
- Bdr representative — Reported that retraining and internal documentation updates on CRLReason Codes were on track to happen that week.
- Bdr representative — Attached a CRLReason Codes re-training presentation (v.1.2).
- Bdr representative — Reported that all measures from the action points were carried out and asked whether the incident could be closed.
- Mozilla representative — Stated it would close the bug on Wed, 11-Sept-2024.