certSIGN: incorrect URL in CCADB record, now remediated and pending closure
This case concerns certSIGN’s incorrect URI in the CRL path field of a CCADB cross-certificate record. certSIGN said the bad URL was introduced during a manual CCADB update, corrected shortly afterward, and did not affect any certificates because the cross-certificate was for a not-yet-included replacement PKI system. The thread also shows that certSIGN later acknowledged the issue should have been disclosed separately and proactively, and that the corrective actions were completed. Those corrective actions included updating the CCADB fill procedure to add an explicit double-check step for URL fields and updating operator training. certSIGN requested closure of the bug after stating the incident was fully remediated. CCADB then posted a final call for comments and said the report would be closed on approximately 2026-07-21. The bug is now resolved with a FIXED resolution.
- certSIGN added an incorrect URI to the CRL path field while updating a CCADB cross-certificate record.
- certSIGN corrected the CCADB record after identifying the incorrect URI.
- certSIGN stated the incident was fully remediated and requested closure of the bug.
- CCADB issued a final call for comments and said the report would close on approximately 2026-07-21.
- certSIGN — certSIGN filed a preliminary incident report describing the incorrect CRL path URI in CCADB and noting it was corrected immediately.
- certSIGN — certSIGN filed the full incident report with timeline, impact statement, and root-cause analysis.
- Community commenter — Ophelia Pague said the issue had been reported to certSIGN and questioned whether it should be disclosed as a separate incident.
- certSIGN — certSIGN acknowledged the incident should have been disclosed separately and proactively and said corrective actions were in progress.
- certSIGN — certSIGN reported completion of the action item to update the fill procedure.
- certSIGN — certSIGN reported completion of the action item to update operator training.
- certSIGN — certSIGN submitted a closure summary stating the incident was fully remediated and asked for the bug to be closed.
- CCADB representative — CCADB posted a final call for comments and said the report would close on approximately 2026-07-21.