Certigna: CRL URL Disclosure
This case concerns Certigna (CA Owner CCADB unique ID A000011) receiving a Certificate Problem Report that the URLs for accessing two CRLs were not listed in the CCADB. The reported CRL URLs were http://crl.dhimyotis.com/servicesca.crl and http://crl.dhimyotis.com/wildca.crl. Certigna investigated and found that the CCADB portal only allows one Full CRL to be entered in the “Full CRL Issued By This CA” field, while the CRLDP extension of the older certificates provides two URLs. Certigna stated that this limitation led to only one of the two URLs being declared in the CCADB portal. As remediation, Certigna reviewed the CCADB field for all CAs declared in the CCADB, consolidated the CCADB information update process, and increased vigilance/raised awareness among teams about declaring CRL URLs. The bug was resolved as FIXED, with a report closure summary requesting closure after completion of the disclosed action items.
- Certigna generated the “Certigna Services CA” and “Certigna Wild CA” certificates and published them in the CCADB portal.
- A third party reported that the CRL access URLs were not listed in the CCADB.
- Certigna published a preliminary incident report describing the CRL URL disclosure issue.
- Certigna raised awareness internally about vigilance when declaring CRL URLs in the CCADB portal.
- The bug was updated to the resolved state (FIXED).
- Dhimyotis representative — Opened a preliminary incident report stating that the CCADB did not list the reported CRL URLs and noting an ongoing full investigation.
- Dhimyotis representative — Published a full incident report explaining that the CCADB portal only allows one Full CRL URL in the relevant field, while older certificates’ CRLDP extension provides two URLs.
- Dhimyotis representative — Provided a report closure summary with root cause, remediation steps (review/consolidation/vigilance), and requested closure after action items were completed.
- CCADB representative — Issued a final call for comments and stated the incident report would be closed around 2026-01-12.