Amazon Trust Services: CRL not DER-encoded
This case concerns Amazon Trust Services serving a CRL via an HTTP URI that returned a PEM-encoded CRL rather than a single DER-encoded CRL, which the reporter cited as a violation of RFC 5280 section 4.2.1.13. The issue was identified in the context of ATS’s CRL deployment and review process after a change from manual to fully automated deployment for Root CRLs. ATS stated that the CRL formatting failure occurred because the automated deployment served a PEM-formatted CRL instead of DER. ATS provided a timeline showing the new CRL was deployed on 2024-08-09, an error was observed by CRLWatch on 2024-08-20, and the CRL in the correct format was deployed on 2024-08-28. ATS reported that the incident was addressed by updating the CRL to the correct format and noted that an alarm for formatting failures on CRLs was completed. The bug was resolved as FIXED, and ATS requested closure as resolved with no further action items.
- ATS deployed a new Root CRL to the HTTP distribution point, which was later found to be PEM-encoded rather than DER-encoded.
- CRLWatch observed an error parsing the HTTP CRL distribution point.
- ATS deployed the CRL in the correct DER format to complete the remediation.
- Mm representative — Reported that the HTTP CRL distribution point returned a PEM-encoded CRL and cited RFC 5280 section 4.2.1.13 requiring a single DER-encoded CRL.
- DigiCert — Acknowledged the issue and said ATS would provide more details after deeper analysis.
- DigiCert — Provided an incident report summary describing the automated deployment change, the PEM-vs-DER cause, the timeline, and lessons learned including completion of an alarm for CRL formatting failures.
- DigiCert — Requested the issue be closed as resolved and stated there were no further action items.
- DigiCert — Reiterated monitoring and requested closure as resolved with no further action items.
- Mozilla representative — Indicated intent to close the bug on or about 18-Sept-2024 if there were no further questions or recommendations.