certSIGN: Inconsistent revocation status (CRL "revoked" vs OCSP "good") for intermediate CA "certSIGN Web CA"
This case concerns an inconsistency in certSIGN’s revocation status for the intermediate CA certificate “certSIGN Web CA” (serial 10034B8E66F50920F6C5), where certSIGN’s CRL showed the certificate as revoked while its OCSP responder returned “good.” The issue was triggered during certSIGN’s planned revocation ceremony for three non-compliant subordinate CA certificates under certSIGN Root CA G2, when certSIGN decided to publish CRL/OCSP within the 24-hour window permitted by CABF Baseline Requirements §4.9.7. certSIGN reported that an error in its automated publication workflow caused CRL publication to occur before the corresponding OCSP database synchronization completed, creating a temporary CRL/OCSP mismatch. certSIGN stated that the inconsistency was identified and corrected within the required 24-hour window, and that CRL and OCSP were resynchronized, with CRL publication completed on 2026-06-10 at 13:40 UTC. certSIGN also reported corrective and preventive actions, including correcting the publication script, updating operational procedures, enhancing monitoring to detect CRL/OCSP inconsistencies, and providing training. The thread includes a closure report requesting closure and a final call for comments ahead of an expected closure date around 2026-07-09. The bug is currently marked RESOLVED with resolution FIXED.
- certSIGN conducted a revocation ceremony for three subordinate CA certificates under certSIGN Root CA G2 and began publishing revocation information.
- certSIGN completed CRL publication at 13:40 UTC after resynchronizing CRL and OCSP.
- Glennonline representative — Reported that the intermediate certSIGN Web CA appeared revoked on the CRL (reason cessationOfOperation) while OCSP returned “good,” with OCSP produced after the CRL entry time.
- Glennonline representative — Provided additional observations that three revoked intermediates returned OCSP “good” despite the CRL marking them revoked.
- certSIGN — Posted a preliminary incident report attributing the discrepancy to an automated workflow adaptation error that published updated CRLs before OCSP synchronization completed.
- certSIGN — Posted a full incident report stating CRL and OCSP were resynchronized within the required 24-hour window and CRL publication completed on 2026-06-10 at 13:40 UTC.
- certSIGN — Stated that the action item to update monitoring has been completed.
- certSIGN — Stated that the action item to update training has been completed.
- certSIGN — Posted a closure report stating corrective and preventive actions were completed and requested Bug 2046230 be closed.
- CCADB representative — Issued a final call for comments or questions ahead of an expected closure date around 2026-07-09.