D-Trust: Defective certificate incident reporting form (truncated internal notifications)
D-TRUST reported a self-discovered issue with its certificate incident reporting web form at https://www.d-trust.net/en/support/reporting-certificate-problem. During external use of the form on 2025/07/09, D-TRUST found that certain reporter-provided contact information fields were not correctly included in the internal email notifications to the incident response team when a certain character limit was exceeded. D-TRUST stated that this affected only internal handling of incoming form data and did not impact the availability of the form. In the specific case on 2025/07/09, the incident team was unable to contact the reporter because the contact information was cut off, although the incident report information was transmitted and processed according to regular procedures. D-TRUST identified a size limitation in generating the internal notification email as the root cause and adjusted the size limitation on 2025/07/10 to prevent recurrence. D-TRUST retested the web form and revised its requirements engineering process on 2025/07/21, and requested closure of the incident report; the bug is marked RESOLVED with resolution FIXED.
- D-Trust released a new web form for certificate incident reports.
- During external use of the certificate incident reporting web form, internal email notifications truncated reporter contact information when character limits were exceeded.
- D-Trust adjusted the size limitation for internal email notifications to prevent the truncation issue from recurring.
- D-Trust revised its requirements engineering process for the web form.
- CCADB planned to close the incident report if no further comments were received.
- Bdr representative — Opened a preliminary incident report stating that internal email notifications from the certificate incident reporting form omitted reporter contact fields when a character limit was exceeded.
- Bdr representative — Posted a full incident report with details including that no certificates were affected and that the issue prevented contacting the reporter due to truncated contact information.
- Bdr representative — Noted there was nothing new to report and that a closure report was being prepared.
- D-Trust — Submitted a closure report describing remediation (adjusted size limitation on 2025-07-10), retesting, and requirements process revisions on 2025-07-21, and requested closure.
- CCADB representative — Issued a final call for comments or questions before the incident report would be closed around 2025-08-18.