GlobalSign: CCADB CRL URL mismatch with issued certificate CDP for EV CA (SHA256-G3)
This case reports a CCADB compliance issue for GlobalSign Extended Validation CA - SHA256 - G3, where the CCADB “Full CRL Issued By This CA” entry used a CRL URL without an extra “/gs/”, while the issued certificates’ CDP contained an extra “/gs/” in the qualifier. The thread states that both URLs locate to the same CRL, but the CCADB URL did not match exactly the CRL URL as it appears in the issued certificates, contrary to CCADB Policy section 6.2. The issue was disclosed via a third-party certificate problem report received on 18/12/2025, and GlobalSign investigated the CCADB record. GlobalSign corrected the CCADB CRL value on 19/12/2025 to align with the CDP from the issued certificates and confirmed no other CA records were affected. GlobalSign also updated its CCADB management procedure to require analysis of production configuration in addition to internal documentation review and added an automated profile check to verify CRL URLs of issued certificates against CCADB records. The thread indicates the remedial activities were completed on 28/01/2026 and GlobalSign requested closure; the bug is currently RESOLVED with resolution FIXED.
- Non-compliance period begins for the affected CCADB/issued-certificate CRL URL alignment.
- GlobalSign receives a third-party certificate problem report about a potential CCADB vs issued-certificate CDP inconsistency.
- GlobalSign confirms the CCADB record issue and corrects the CCADB CRL URL to match the issued certificates’ CDP.
- GlobalSign completes implementation of an automated profile check to verify CRL URLs against CCADB records.
- GlobalSign posts the incident report closure summary and requests closure.
- Bug is set to RESOLVED (FIXED).
- GlobalSign nv-sa — GlobalSign provides a preliminary incident report describing the CCADB CRL URL mismatch (missing “/gs/” vs issued-certificate CDP) and states it updated the CCADB entry and is investigating.
- GlobalSign nv-sa — GlobalSign posts a full incident report with timeline, states issuance was not stopped because both URLs point to the correct CRL, and lists corrective actions taken (including correcting the CCADB value).
- GlobalSign nv-sa — GlobalSign reports completion of an action item updating the CCADB management procedure to analyze production configuration in addition to internal documentation review.
- GlobalSign nv-sa — GlobalSign states it is on track to implement an automated profile check to verify CRL URLs by January 30, 2026.
- GlobalSign nv-sa — GlobalSign repeats it is on track for the automated profile check implementation by January 30, 2026.
- GlobalSign nv-sa — GlobalSign states the automated profile check was completed on January 28, 2026, and that it will post a closure report by February 5, 2026.
- GlobalSign nv-sa — GlobalSign posts the closure summary, describing the root cause and remediation (procedure update, corrected internal documentation, and automated profile check) and requests closure.
- CCADB representative — CCADB incident reporting requests final comments and states the incident will be closed approximately 2026-02-12.