← Amazon Trust Services cases
Bugzilla #2009525
Self Reported Incident
Amazon Trust Services: Additional CRL Characteristics Desired in CP/CPS
RESOLVED
FIXED
Amazon Trust Services
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Amazon Trust Services (ATS) disclosed an incident regarding the lack of clarity in their Certificate Policy (CP) and Certification Practice Statement (CPS) about the behavior of their Certificate Revocation Lists (CRLs). The issue arose when a third party reported that ATS's CRLs sometimes included backdated 'thisUpdate' timestamps to account for clock skew. ATS confirmed this practice and committed to updating their CP/CPS to provide clearer information about CRL behavior. The updates were completed by January 30, 2026, and ATS plans to continue evaluating their documentation in response to inquiries.
Chronology
- ATS received a report questioning the behavior of their CRLs.
- ATS updated their CP/CPS with additional clarity regarding CRL behavior.
Thread Activity
- DigiCert — ATS disclosed the incident and outlined the timeline of events.
- DigiCert — ATS confirmed that they are on track to complete CP/CPS updates.
- DigiCert — ATS reiterated their commitment to complete CP/CPS updates by the due date.
- DigiCert — ATS reported that all action items have been completed and requested closure of the report.
Participants
DigiCert
CCADB representative
Community commenter
Apple representative
Mozilla representative
Google representative
External References
Similar Local Cases
Amazon Trust Services: Missing CAA Check For Test Website Certificates
Amazon Trust Services: Test revoked certificates with invalid validity period
SECOM: S/MIME CA Modified Opinion Report of Cybertrust Japan (CTJ)
Apple: Public Key Reuse
DigiCert: Threat of legal action to stifle Bugzilla discourse
Amazon Trust Services: No Space In Private Organization
IZENPE: IssuingDistributionPoint extension in CRLs not marked as Critical
Google Trust Services: Missing authorization audit log entry for certificate issuance