Asseco DS / Certum: CRL URLs disclosed in CCADB do not exactly match the CRL URLs in certificates
Certum (Asseco Data Systems S.A.) received a Certificate Problem Report on 2025-12-18 indicating that CRL URLs for valid certificates were present in certificates but did not exactly match the values published in CCADB under the field "Full CRL Issued By This CA". Certum’s investigation found that the mismatches were due to string-level differences, including use of HTTPS instead of HTTP in CCADB and, for some SubCA records, omission of dedicated CRL subdomains. Certum stated that all listed URLs resolved to the intended CRLs corresponding to the respective certificates, and that certificate issuance was not stopped because the incident did not affect issuance, revocation, or validation behavior. Certum reviewed and corrected the affected CCADB records (107 CRL URL disclosures) to ensure exact string-level alignment with the CRL Distribution Point values in the corresponding certificates. Certum also updated internal procedures to require verbatim copying of CRL URLs from certificates and mandatory verification of exact matches, and implemented a consistency check to support verification against issued certificates. The bug is marked RESOLVED with resolution FIXED, and Certum reported completion of corrective actions.
- Certum received a Certificate Problem Report about CRL URL mismatches between certificates and CCADB disclosures.
- Certum became aware of the incident, investigated, and fixed the affected CCADB CRL records.
- Certum reported completion of the remaining corrective action items and confirmed all corrective actions were complete.
- Assecods representative — Published a preliminary incident report stating that CCADB CRL URLs did not exactly match certificate-encoded CRL URLs (e.g., HTTPS vs HTTP and hostname differences) and cited CCADB Policy v2.0 section 6.2.
- Assecods representative — Published a full incident report describing the confirmed causes, stating all URLs resolved to correct CRLs, and listing action items and timeline including CCADB record fixes on 2025-12-19 12:00 UTC.
- Assecods representative — Requested setting the “Next update” field to 2026-01-15 for an action item due date.
- Assecods representative — Provided a status update showing procedure updates and one-time review completed, and requested updating the “Next update” field to 2026-03-31 for the ongoing consistency-check item.
- Assecods representative — Reported that the consistency check action item was complete (completed 2026-03-16) and confirmed completion of all corrective actions.
- Assecods representative — Submitted a report closure summary stating remediation included reviewing and correcting CCADB records, updating procedures, and implementing a consistency check.
- CCADB representative — Posted a final call for comments and indicated the incident report would be closed on approximately 2026-03-30.