← Microsoft Corporation cases
Bugzilla #1990801
Self Reported Incident
Microsoft: improper disclosure of CRL
RESOLVED
FIXED
Microsoft Corporation
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
This case involves Microsoft PKI Services disclosing an incident related to the improper formatting of a Certificate Revocation List (CRL) for the 'Microsoft TLS G2 ECC CA OCSP 06'. The issue was identified on September 25, 2025, after a user reported that the JSON array of partitioned CRLs was incorrectly formatted, missing necessary bracket symbols. Microsoft promptly investigated and resolved the issue within hours. They have since implemented remediation actions, including posting only Full CRLs and enhancing validation processes for future updates. The case has been resolved and closed.
Chronology
- Microsoft PKI Services updated metadata for new CAs, leading to a formatting error in the CRL.
- The formatting issue was reported and resolved by Microsoft PKI Services.
Thread Activity
- Mm representative — Microsoft disclosed an improperly formatted JSON array of CRLs.
- Microsoft Corporation — Preliminary incident report detailing the formatting error and resolution timeline.
- Microsoft Corporation — Full incident report submitted, outlining the root causes and remediation actions.
- Microsoft Corporation — Report closure summary provided, confirming completion of all action items.
Participants
Mm representative
Microsoft Corporation
External References
Similar Local Cases
Microsoft PKI Services: Failure to report Bugzilla 2026452 within 72 hrs
Microsoft PKI Services: Failure to publish Full Incident Report for Bugzilla 2021175 within 14 days
Microsoft PKI Services: "unknown" OCSP response for issued certificates
Microsoft PKI Services: End Entity Certificate Mis-issuance against CPS (BasicConstraints)
Microsoft PKI Services: Underscore in SAN
Microsoft PKI Services: Malformed ICAs (missing certificate policy extensions)
Microsoft PKI Services: Failure to disclose Unconstrained Intermediate within 7 Days
Microsoft PKI Services: Unrevoked 4 intermediate certificates