OATI incident report: AIA CA Issuer field pointed to a PEM-encoded file instead of DER
This case is OATI’s incident report about an Authority Information Access (AIA) CA Issuer pointer in OATI TLS certificates resolving to a PEM-encoded file instead of the DER-encoded format required by RFC 5280. OATI said it became aware of the issue on 2026-04-29 and republished the issuer certificate files in DER format on 2026-05-21. The report states that certificate issuance was not paused because the problem was limited to the externally hosted issuer file and did not affect certificate contents, validation, key material, or revocation status information. OATI later added root-cause detail and action items covering internal instructions, encoding verification, incident-response timeliness, and monitoring of public incident reports. By 2026-08-05, OATI said all action items were complete and requested closure, and CCADB issued a final call for comments on 2026-08-06. The case was resolved with FIXED.
- OATI published the Server Issuing CA 2025 issuer certificate file.
- OATI became aware that the AIA CA Issuer pointer referenced a PEM-encoded file instead of DER.
- OATI republished the issuer certificate files in DER format.
- OATI stated that all action items were complete and requested closure.
- Oati representative — OATI filed a full incident report describing the PEM-encoded AIA CA Issuer file, the remediation, and the timeline.
- Community commenter — A community member questioned the timeliness of OATI’s handling and reporting.
- Oati representative — OATI added more root-cause detail, including incomplete internal instructions, no encoding verification process, and no continuous-improvement process.
- Oati representative — OATI said it first became aware when the issue was posted on Bugzilla and acknowledged the gap between responses and the solution.
- Oati representative — OATI updated its action items, including automated monitoring/alerting and incident-response improvements.
- Oati representative — OATI reported completion of the monitoring/alerting and incident-review action items, with incident-response process work still ongoing.
- Oati representative — OATI said the remaining incident-response process action item was completed on 2026-07-28.
- Oati representative — OATI posted a closure summary stating that the issuer files were replaced with DER files and all action items were completed.
- CCADB representative — CCADB issued a final call for comments or questions and said the report would otherwise be closed around 2026-08-13.