Disig: Missing CA Disig R2I2 Certification Service Full CRL URLs in CCADB
This case reports that CCADB information for the CA Disig R2I2 Certification Service was non-compliant: the “Pertaining to Certificates Issued by this CA” section listed a Full CRL URL that was not found in the issued valid TLS certificates for end clients. Disig stated that it received a report of the issue on 2025-12-18, confirmed the missing full CRL URL in CCADB, and identified one impacted intermediate certificate. Disig created this Bugzilla bug on 2025-12-19 and updated the relevant CCADB entries for the CA Disig R2I2 Certification Service full CRL URLs on 2025-12-19. The incident report states that there was no misissuance and that the appropriate CCADB entries were updated promptly to correct the issue. Disig’s report attributes the problem to a combination of human error and procedural deficiency, including insufficient attention to CCADB policy changes and the visual similarity between distribution point URLs. The bug is marked RESOLVED with resolution FIXED, and Disig requested closure after stating that the disclosed action items were completed.
- Non-compliance with CCADB policy requirements for Full CRL URL listing began for the Disig R2I2 Certification Service.
- Disig received a report that CCADB information for the subordinate CA’s Full CRL URL did not match the issued valid TLS certificates.
- Disig updated the CCADB entries for the Disig R2I2 Certification Service Full CRL URLs and created the Bugzilla incident report.
- The bug was last changed and remains marked RESOLVED/FIXED.
- Disig, a.s. — Disig provided a preliminary incident report stating that the missing CRL distribution point in CCADB for the CA Disig R2I2 Certification Service had been resolved, and that a full investigation was in progress.
- Disig, a.s. — Disig created an attachment (Appendix R2I2 Details CSV) for the bug.
- Disig, a.s. — Disig posted the full incident report with timeline, impact (single subordinate CA certificate CCADB entry), root cause analysis, and remediation details.
- Disig, a.s. — Disig posted a report closure summary describing the incident, root causes (human error and procedural deficiency), remediation (cross-check audit, four-eyes validation, and a compliance checklist), and requested closure.
- CCADB representative — CCADB incident reporting asked for final comments and noted the report would be closed around 2026-01-20.
- Disig, a.s. — Disig provided an action items update and then corrected that some information should be ignored because it related to a different bug list.