← Netlock cases
Bugzilla #1938167
Incident
NETLOCK: CRL not published in DER Encoded Format
RESOLVED
FIXED
Netlock
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
NETLOCK reported a compliance issue regarding the encoding of Certificate Revocation Lists (CRLs) published in PEM format instead of the required DER format, violating RFC 5280. The issue was identified on December 17, 2024, and NETLOCK promptly changed the encoding format to DER on December 18, 2024. They confirmed that no subscribers were impacted by this issue, as the certificates were not malformed. NETLOCK has since implemented a new validation process to prevent future encoding errors, including the integration of a linter for ongoing compliance checks. All action items related to this incident have been completed, and NETLOCK has requested closure of the case.
Chronology
- Notification received about improperly encoded CRLs.
- NETLOCK changed the CRL encoding from PEM to DER.
- Implementation of the pkimetal linter for validation completed.
Thread Activity
- Netlock — Preliminary Incident Report submitted detailing the CRL encoding issue.
- Netlock — Incident Report submitted with further details and action items.
- Netlock — Request for closure submitted after completing all action items.
Participants
Netlock
Jesperkristensen representative
Sectigo
Mozilla representative
CCADB representative
External References
Similar Local Cases
NETLOCK: did not file a preliminary incident report or respond to a third-party report within the 72-hour timeframe
NETLOCK: Missing Related Incidents section in the bug report
NETLOCK: Disclosed CRL is expired
NETLOCK: CA/Browser Forum TLS BR Non-compliance
NETLOCK: Expired Test Website Certificate
NETLOCK: Missing CDP Disclosure in CCADB
NETLOCK: Full Incident Report was not published within 14 days of notification
Netlock: unspecifed revocation code (0) in CRL