Netlock incident: AIA CA Issuers endpoints served PEM-encoded CA certificates instead of DER
This case concerns Netlock’s incident report about Authority Information Access (AIA) CA Issuers HTTP endpoints that returned issuer certificates in PEM format instead of the DER encoding required by RFC 5280 section 4.2.2.1. Netlock opened the bug after stating that the issue was identified through an external community report received on 2025-12-06. Netlock reported affected hierarchies including DVCA, trustev3, qtrustev3, and pdvca, and later acknowledged that an initial production deployment completed on 2026-01-08 did not fully resolve the problem because some endpoints were still serving PEM content. Netlock said remediation requires software changes because the affected URLs are generated by a publishing component in its certificate lifecycle and publishing infrastructure rather than by static files or simple web server configuration. The thread also includes repeated feedback from Apple, Mozilla, and community participants that Netlock’s handling of the Related Incidents section did not comply with CCADB Incident Reporting Guidelines; Netlock later said it opened a separate corresponding ticket and updated the related-incidents list in this bug. In the latest update, Netlock reported that one preventive action item was completed on 2026-07-15: after discussion with its auditor, audit procedures were updated so AIA CA Issuers endpoints are explicitly retrieved and their encoding verified during audit testing, with evidence retained. Netlock also published revised target dates of 2026-08-13 for the remaining open items: deploying the additional corrective fix and implementing automated AIA validation across affected publishing paths, including the previously reported ca=gold path, after which it plans to publish a closure summary. The bug remains open and assigned.
- Non-compliant AIA configuration was introduced for the pdvca hierarchy.
- Non-compliant AIA configuration was introduced for the trustev3 and qtrustev3 hierarchies.
- Non-compliant AIA configuration was introduced for the DVCA hierarchy.
- Netlock said an external community report identified the AIA encoding non-compliance.
- Netlock said its initial production deployment was completed.
- Netlock staff and an external observer reported that some AIA endpoints were still serving PEM-encoded content.
- Netlock said testing identified and corrected an implementation defect, and re-testing began.
- Netlock said auditor procedures were updated so AIA CA Issuers endpoints are explicitly retrieved and their encoding verified during audit testing.
- Netlock set 2026-08-13 target dates for the additional corrective fix and automated AIA validation.
- Netlock — Netlock opened the bug with a preliminary incident report stating that a third party had reported an AIA CA Issuers URI returning PEM content instead of DER.
- Community commenter — A community commenter said Netlock had not provided a satisfactory full incident report within 14 days and listed additional PEM-serving AIA URLs.
- Netlock — Netlock posted a full incident report describing affected hierarchies, dates, root causes, and a planned production release.
- Netlock — Netlock said demo validation had been completed and production deployment was still planned for 2026-01-09.
- Netlock — Netlock said production deployment had been completed on 2026-01-08 and that a closure summary would follow.
- Google representative — Google reported that several endpoints were still serving PEM-encoded certificates after the claimed deployment.
- Community commenter — A commenter said Netlock’s report did not follow CCADB incident-reporting guidance and included unsupported boilerplate claims.
- Apple representative — Apple asked Netlock to explain why similar prior bugs were not listed as related incidents and whether Netlock reviews other CAs’ incident reports.
- Netlock — Netlock updated its full incident report, acknowledged that PEM content was still being served from some endpoints, and added a second corrective-fix timeline.
- Netlock — Netlock said it limited Related Incidents to its own operations and described plans for an internal knowledge base.
- Apple representative — Apple said Netlock’s interpretation of Related Incidents was incompatible with the CCADB Incident Reporting Guidelines and requested a separate incident for that process non-compliance.
- Mozilla representative — Mozilla reiterated that Netlock should review public incident documentation from other CAs and file a separate incident report for the reporting non-compliance.
- Netlock — Netlock said it had opened the corresponding ticket to analyze and address the incident-reporting non-compliance referenced by the community.
- Netlock — Netlock posted updated action items and added a list of related incidents from other bugs.
- Netlock — Netlock explained that the remediation required a new software release because the affected URLs were generated by an integrated publishing component.
- Netlock — Netlock said testing had identified an implementation defect, that it had been corrected, and that re-testing was underway.
- Netlock — Netlock re-baselined its remaining action items, marking the additional corrective fix and automated validation as in progress with updated dates still to be determined.
- Netlock — Netlock said the corrected implementation remained under validation and preventive measures were progressing in parallel.
- Netlock — Netlock said no new blocking issues had been identified and that validation was ongoing.
- Netlock — Netlock said testing and verification continued and updated target dates would follow after validation and release planning.
- Netlock — Netlock said the remaining action items were still in progress and validation continued.
- Netlock — Netlock said there were no material changes and that validation and preventive actions remained underway.
- Netlock — Netlock said validation and release preparation for the remaining action items were ongoing.
- Netlock — Netlock said the additional corrective fix, automated AIA validation, and auditor-scope clarification were still in progress.
- Netlock — Netlock said no additional action item had been completed and that revised target dates for the remaining open items were still being finalized.
- Netlock — Netlock said another round of testing found no new defect, that remaining action items were still in progress, and that updated target dates and closure evidence were being prepared.
- Netlock — Netlock said no new issues had surfaced, the remaining action items were still in progress, and no additional action item had been completed during the latest reporting period.
- Netlock — Netlock reported that auditor-scope clarification was completed on 2026-07-15 and set 2026-08-13 target dates for the additional corrective fix and automated AIA validation.