Kamu SM: Incorrect CRL served at SSL CRL distribution point; incident report closed after final call
Kamu Sertifikasyon Merkezi (Kamu SM) reported a CRL publication incident affecting its production SSL CRL distribution point at http://depo.kamusm.gov.tr/ssl/SSLSIL.S3.crl. The incident began on 2026-06-17 during a key rollover for the Mobile Qualified Electronic Certificate subordinate CA, when a manual configuration change in the CRL copy service caused an unintended CRL to be served. Kamu SM said the issue was detected by CRLWatch and reported by a community member, and that it corrected the configuration and restored the proper CRL on 2026-06-18 at 06:00 UTC. In its closure update, Kamu SM stated that no certificates were revoked or issued during the incident window and that all action items were completed, including peer review for manual CRL path changes and Nagios CRL integrity monitoring. CCADB then issued a final call for comments on 2026-07-27 and said the incident report would be closed on approximately 2026-08-03. The bug is now RESOLVED with resolution FIXED.
- A key rollover for the Mobile Qualified Electronic Certificate subordinate CA caused an incorrect CRL to be served at the production SSL CRL distribution point.
- Kamu SM restored the correct CRL at the production distribution point.
- Kamu SM completed the Nagios CRL integrity monitoring action item and stated that all action items were complete.
- The incident report was scheduled to be closed after the final call for comments.
- Tubitak representative — Posted a preliminary incident report describing the CRL copy service configuration error and noting that the source of disclosure was a third-party report.
- Tubitak representative — Posted the full incident report with the timeline, impact, and remediation details, and attached SSL_CRL.zip.
- Tubitak representative — Requested a next update of 2026-07-20 while working on an action item.
- Tubitak representative — Reported no changes and again requested a next update of 2026-07-20.
- Tubitak representative — Reported no changes and said the action item was expected to be finalized and closed by 2026-07-20.
- Tubitak representative — Stated that the Nagios CRL integrity monitoring action item was completed, that all action items were complete, and requested closure of the incident report.
- CCADB representative — Issued a final call for comments or questions and said the incident report would be closed on approximately 2026-08-03.