← D-TRUST cases
Bugzilla #1924385
Ca Certificate Compliance
Revocation Issue
Closure Request
D-Trust: Missed Revocation of TLS certificates affected by Bugzilla 1884714
RESOLVED
FIXED
D-TRUST
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
D-Trust issued TLS certificates containing an LDAP-URL in the Subscriber Certificate Authority Information Access field after September 15, 2023. Upon discovering this issue, D-Trust revoked 2,601 affected certificates within the required timeframe. However, four additional certificates with non-compliant AIA entries were later identified and revoked by October 15, 2024. The root cause was attributed to connection issues between the Nexus CM and CSM, which were not detected during testing. D-Trust has since implemented processes to prevent future occurrences, including an error-tolerant data synchronization system and improved logging practices.
Chronology
- Entry into force of the provisions from Ballot SC62
- Revocation of 2,601 affected TLS certificates
- Revocation of 4 additional affected certificates
Thread Activity
- Bdr representative — Preliminary report detailing the incident and initial actions taken.
- Bdr representative — Final report published with detailed timeline and root cause analysis.
- CCADB representative — Final call for comments or questions on the Incident Report.
Participants
Bdr representative
Google representative
Mozilla representative
D-Trust
Community commenter
CCADB representative
External References
Related Bugzilla IDs Mentioned
Similar Local Cases
D-TRUST: Private Key Disclosed by Customer as Part of CSR
D-TRUST: Certificate with RSA key where modulus is not divisible by 8
D-Trust: QCStatement with http link of PKI Disclosure Statements
D-TRUST: Issuance of non-conformant SSL certificate
D-Trust: Issuance of an EV certificate containing a mixup of the Subject's postalCode and localityName
D-TRUST: Wrong key usage (Key Encipherment)
D-Trust: Missing Pre-Signing Linting for TLS Issuance
D-Trust: "unknown" OCSP response for issued certificates