DigiCert: CRLDP URLs in issued certificates did not exactly match CCADB disclosures (resolved)
DigiCert received an external report that a small number of issued certificates contained CRL Distribution Point (CRLDP) URLs that did not exactly match the URLs disclosed in CCADB. The reporter initially identified 4 CRLDP URLs, and DigiCert’s internal research later identified 334 affected CRLDP URLs. DigiCert stated that issuance was not stopped because the certificates included valid and operational CRLDPs, and that the CCADB disclosures for affected CAs would be updated with amended CRLDP values. DigiCert attributed the mismatch to changes to the CCADB API introduced on August 26, 2024, which disrupted automated CRL synchronization; automated synchronization was disabled on April 14, 2025 and a manual update workaround did not track CRL URL changes adequately. DigiCert completed a comprehensive audit of affected CRLs and updated CCADB disclosures with amended CRLDP values, and it restored automated CRLDP updates via the CCADB API by February 1, 2026. The bug was resolved with resolution set to FIXED, and DigiCert requested closure after completing all action items.
- CCADB API changes disrupted DigiCert’s automated CRL synchronization process.
- Non-compliance began, with leaf certificates using CRLDP URLs that deviated from CCADB disclosures.
- The CRLDP mismatch was identified as part of the incident investigation.
- DigiCert resolved the mismatches and completed remediation as described in the closure summary.
- Automated CRLDP updates via the CCADB API were restored.
- DigiCert — Filed a preliminary incident report stating that a third party reported CRLDP URLs in issued certificates that did not exactly match CCADB disclosures.
- DigiCert — Submitted a full incident report identifying 4 initially reported CRLDP URLs and 334 affected CRLDP URLs after internal research, and described the remediation approach.
- DigiCert — Reported that DigiCert was on track to restore CRLDP synchronization by 2026-02-01 and requested the “Next update” whiteboard field be set for 2026-02-02.
- DigiCert — Stated that all action items were completed and that a closure summary would be posted by early next week.
- DigiCert — Posted a closure summary describing the root cause, remediation, and completion of action items, and requested closure.
- CCADB representative — Issued a final call for comments before the incident report would be closed approximately 2026-02-16.