D-Trust: CRLs of CAs issuing CA certificates exceed the maximum validity period

RESOLVED FIXED D-TRUST

This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update. Always refer to the official Bugzilla thread as the authoritative source. If you spot an inaccuracy, let me know via the contact form.

AI Summary

D-Trust reported a compliance issue regarding the validity period of Certificate Revocation Lists (CRLs) for CAs issuing CA certificates, which exceeded the maximum permitted validity period by approximately one day. The issue was identified following a third-party report, and D-Trust confirmed that the CRLs were operationally republished but did not comply with the CA/Browser Forum TLS Baseline Requirements. The non-compliance was addressed by correcting the CRL profile and implementing automated linting to prevent future occurrences. The incident was resolved on January 15, 2026, with all action items completed and monitoring measures put in place.

Model: gpt-4o-mini Generated: 2026-06-13 21:34 UTC Revised: 2026-06-16 18:48 UTC Confidence: 0.85 12 comments

Chronology

2024-03-15 Non-compliance started when CRLs were issued exceeding the maximum CRL validity period.
2026-01-14 Non-compliance identified following a third-party report.
2026-01-15 First corrected CRL produced and published, resolving the non-compliance.

Thread Activity

2026-01-15 D-Trust — Preliminary Incident Report submitted regarding CRLs exceeding validity period.
2026-01-19 D-Trust — Full Incident Report provided detailing the non-compliance and its timeline.
2026-02-20 D-Trust — Report Closure Summary issued, confirming completion of action items and resolution.

Participants

D-Trust Fastly representative Bdr representative CCADB representative

External References

Original Bugzilla Case

Related Bugzilla IDs Mentioned

#1731164 #1732745 #1734265 #1735998 #1737057 #1737242 #1738191 #1738421

Similar Local Cases

#1976837 RESOLVED Incident Opened 2025-07-11 · Closed 2025-08-19 · 100% similar

D-Trust: Defective certificate incident reporting form

AI Summary CA Owner

#2009149 RESOLVED Incident Opened 2026-01-08 · Closed 2026-04-19 · 100% similar

D-Trust: Expired certificate provided on the CA TLS test website for demonstration of valid certificates

AI Summary CA Owner

#2037000 ASSIGNED Self Reported Incident Certificate Misissuance Problem Reporting Failure Opened 2026-05-05 Still Open · 87% similar

D-Trust: Missing Pre-Sign Linting for S/MIME Issuing CAs

AI Summary CA Owner

#1682270 RESOLVED Ca Certificate Compliance Incident Closure Request Opened 2020-12-14 · Closed 2026-06-12 · 86% similar

D-TRUST: Private Key Disclosed by Customer as Part of CSR

AI Summary CA Owner

#2007116 ASSIGNED Ca Certificate Compliance Incident Self Reported Incident Externally Reported Incident Opened 2025-12-19 Still Open · 85% similar

D-Trust: CRL URL Disclosure

AI Summary CA Owner

#1963663 RESOLVED Incident Certificate Misissuance Opened 2025-04-30 · Closed 2025-06-12 · 75% similar

Certigna: Multiple Reserved Certificate Policy Identifiers in CA certificates

AI Summary CA Owner

#1938167 RESOLVED Incident Opened 2024-12-18 · Closed 2025-06-10 · 71% similar

NETLOCK: CRL not published in DER Encoded Format

AI Summary CA Owner

#1390991 RESOLVED Ca Certificate Compliance Incident Certificate Misissuance Opened 2017-08-16 · Closed 2023-02-22 · 71% similar

Disig: Non-BR-Compliant Certificate Issuance

AI Summary CA Owner