Google Trust Services: Incomplete CRL Distribution Point URLs in CCADB for GTS Roots
Google Trust Services (GTS) reported that the Common CA Database (CCADB) entries for Certificate Revocation List (CRL) Distribution Point URLs for its root CAs were not fully accurate. For GTS Roots R1–R4, CCADB disclosed incomplete sets of HTTP CRL URLs, omitting newer shorter URLs that appeared in the CRL Distribution Points of recently issued intermediate CA certificates. For GlobalSign Root CA R4 (GSR4), CCADB listed an incorrect CRL URL that appeared to have never been used in any unexpired certificate issued by GSR4. GTS stated that revocation data was still served correctly at the disclosed URLs and that no certificates were mis-issued, characterizing the incident as contained and limited to CCADB data incompleteness. GTS corrected the CCADB entries to include the complete set of distinct CRL URLs and updated internal processes, including expanding CCADB access to more SMEs, adding a post-ceremony checklist step to update CCADB CRL URLs when issuing new intermediate CAs, and increasing rigor in CCADB policy review and incident review processes. The bug was resolved as FIXED, with GTS requesting closure after completing the disclosed action items.
- GTS identified the start of non-compliance for GSR4 (14 days after CCADB Policy v2.0 effective date).
- GTS identified the start of non-compliance for GTS Roots R1–R4 (14 days after CCADB Policy v2.1 effective date).
- GTS identified the CCADB CRL URL disclosure incompleteness/incorrectness.
- GTS stated the non-compliance period ended.
- GTS published the full incident report and described remediation and impact.
- GTS reported completion of action items and requested closure; CCADB issued a final call for comments.
- Google representative — GTS opened a preliminary incident report stating CCADB-disclosed CRL Distribution Point URLs for GTS roots were incomplete/incorrect and requested updating nextUpdate to 2026-04-24.
- Google representative — GTS posted a full incident report describing the CCADB policy non-compliance, impact, and the specific missing/incorrect CRL URLs.
- Google representative — GTS removed a mistakenly re-added needInfo flag.
- Google representative — GTS provided an action-item table and reported completion of access expansion, CRL URL fixes, checklist updates, and policy/incident review process updates.
- Google representative — GTS submitted a report closure summary stating the incident was corrected in CCADB and all action items were completed, requesting closure.
- CCADB representative — CCADB issued a final call for comments or questions before closing the bug around 2026-05-29.