GlobalSign: CCADB JSON Array of all Full CRL URLs incomplete for 6 Cross-Certified Root CA records
GlobalSign reported a CCADB compliance incident in which the CCADB “JSON Array of all Full CRL URLs” values for 6 Cross-Certified Root CAs were incomplete compared to the Self-signed versions of the same Root CAs. GlobalSign stated that the Cross-Certified Root CA CCADB records contained only a subset of the CRL URLs present in the corresponding Self-signed Root CA records. The issue was identified via internal review during CCADB review, and GlobalSign updated the CCADB records for the 6 Cross-Certified Root CAs to align them with their Self-signed versions. GlobalSign also reported that issuance was not stopped because the CRL URLs were disclosed at the Root CA certificate level and CRLs were available. GlobalSign completed deployment of CCADB monitoring checks for Cross-Certified CA CRL URLs on May 15, 2026, and requested closure after remediation and process updates. The bug is marked RESOLVED with resolution FIXED.
- GlobalSign’s CCADB “JSON Array of all Full CRL URLs” field requirement took effect, and the Cross-Certified Root CA records were not aligned with the Self-signed versions.
- GlobalSign’s internal review identified a discrepancy between Self-signed Root CA records and Cross-Certified Root CA records for CRL URL arrays.
- GlobalSign updated the CCADB records for 6 Cross-Certified Root CAs to align CRL URL arrays with the corresponding Self-signed Root CAs.
- GlobalSign completed deployment of CCADB monitoring checks for Cross-Certified CA CRL URLs.
- The incident report was closed in the bug tracker.
- GlobalSign nv-sa — GlobalSign submitted a preliminary incident report stating that CCADB CRL URL arrays for 6 Cross-Certified Root CAs were incomplete versus their Self-signed versions and that CCADB records were updated.
- GlobalSign nv-sa — GlobalSign posted a full incident report describing the timeline, the policy basis (CCADB Policy section 6.2), internal review findings, and the update of 6 Cross-Certified Root CA certificate records on 2026-04-22.
- GlobalSign nv-sa — GlobalSign stated it completed deployment of CCADB monitoring with checks for Cross-Certified CA CRL URLs on May 15, 2026, and would post a closure report by May 25, 2026.
- GlobalSign nv-sa — GlobalSign provided a report closure summary with root causes, remediation steps (CCADB record updates, change management procedure updates, and extended monitoring), and requested closure.
- CCADB representative — CCADB incident reporting requested final comments and stated the incident would be closed approximately 2026-06-01.