Kamu SM: Incorrect CRL served at SSL CRL distribution point; final call issued for closure

Kamu Sertifikasyon Merkezi (Kamu SM) reported a CRL publication incident affecting its production SSL CRL distribution point at http://depo.kamusm.gov.tr/ssl/SSLSIL.S3.crl. The incident began on 2026-06-17 during a key rollover for the Mobile Qualified Electronic Certificate subordinate CA, when a manual configuration change in the CRL copy service caused an unintended CRL to be served. Kamu SM said the issue was detected by CRLWatch and reported by a community member, and that it corrected the configuration and restored the proper CRL on 2026-06-18 at 06:00 UTC. In its closure update, Kamu SM stated that no certificates were revoked or issued during the incident window and that all action items were completed, including peer review for manual CRL path changes and Nagios CRL integrity monitoring. The latest thread activity is a final call for comments from CCADB incident-reporting, which says the report will be closed on approximately 2026-08-03 if there are no further questions. The case remains ASSIGNED.

1. 2026-06-17 A key rollover for the Mobile Qualified Electronic Certificate subordinate CA caused an incorrect CRL to be served at the production SSL CRL distribution point.
2. 2026-06-18 Kamu SM restored the correct CRL at the production distribution point.
3. 2026-07-20 Kamu SM completed the Nagios CRL integrity monitoring action item and stated that all action items were complete.

1. 2026-06-18 Tubitak representative — Posted a preliminary incident report describing the CRL copy service configuration error and noting that the source of disclosure was a third-party report.
2. 2026-06-23 Tubitak representative — Posted the full incident report with the timeline, impact, and remediation details, and attached SSL_CRL.zip.
3. 2026-06-30 Tubitak representative — Requested a next update of 2026-07-20 while working on an action item.
4. 2026-07-07 Tubitak representative — Reported no changes and again requested a next update of 2026-07-20.
5. 2026-07-14 Tubitak representative — Reported no changes and said the action item was expected to be finalized and closed by 2026-07-20.
6. 2026-07-20 Tubitak representative — Stated that the Nagios CRL integrity monitoring action item was completed, that all action items were complete, and requested closure of the incident report.
7. 2026-07-27 CCADB representative — Issued a final call for comments or questions and said the incident report would be closed on approximately 2026-08-03.