CFCA CRL encoding incident: missing RSA NULL parameter and empty revokedCertificates field
CFCA reported a CRL encoding incident affecting four CRLs: the RSA signatureAlgorithm field was missing the required NULL parameter, and one DVOCA CRL also had an empty revokedCertificates field when no certificates were revoked. The issue was first identified by a third party, XiPKI, and CFCA’s compliance team then began incident response after forwarded reports were received. CFCA stated that the problem affected CRL infrastructure only, did not affect subscriber certificates or issuance, and OCSP revocation checking continued to function normally. CFCA separated this CRL issue from Bug 2031281, completed the listed remediation steps, and filed a closure report requesting that the incident report be closed. The thread shows a final call for comments from CCADB, with closure expected around 2026-06-23 if no further questions were raised.
- CABatch CRL generation software was deployed with an ASN.1 encoding deficiency affecting RSA signatureAlgorithm encoding.
- The CRL encoding issue was identified and CFCA employees received forwarded reports.
- CFCA manually verified that all four CRLs had the signatureAlgorithm encoding issue, and the DVOCA CRL empty revokedCertificates issue was self-discovered.
- CFCA completed the fixes and regenerated the affected CRLs.
- CFCA submitted a closure report requesting the incident report be closed.
- Community commenter — Opened the bug with a preliminary incident report describing the CRL signatureAlgorithm NULL-parameter issue and noting it was reported by XiPKI.
- Community commenter — Posted the full incident report, including impact, timeline, affected CRL URLs, and the fact that the issue was reported by a third party.
- Community commenter — Reported that all action items had been completed and listed the completed remediation steps.
- Community commenter — Posted the closure report and requested closure of the incident report.
- CCADB representative — Issued a final call for comments and said the report would be closed around 2026-06-23 if there were no further questions.