Kamu SM: Incorrect CRL Served at SSL CRL Distribution Point
The bug describes an incident where, on 2026-06-17, a configuration error in the CRL publication process during a key rollover operation caused a CRL from a different subordinate CA environment to be copied to the production SSL CRL Distribution Point (http://depo.kamusm.gov.tr/ssl/SSLSIL.S3.crl). As a result, the CRL issuer DN did not match the subject DN of the production SSL subordinate CA, producing a CRL issuer mismatch error reported via CRLWatch. The issue was identified promptly and the correct CRL was restored, allowing the distribution point to resume providing the correct CRL file. The reporter states that a full incident report is being prepared and will be submitted after root cause analysis. The incident disclosure is described as “Third Party Reported,” and the relevant policies referenced are BR Section 2 (Publication and Repository Responsibilities) and Section 4.9.7 (CRL Issuance Frequency).
- During key rollover for the Mobile Qualified Electronic Certificate Subordinate CA, an incorrect CRL was copied to the production SSL CRL distribution point, causing an issuer DN mismatch error.
- The correct CRL was restored and the SSL CRL distribution point resumed providing the correct CRL file.
- A preliminary incident report bug was filed describing the CRL publication process configuration error and planned root-cause analysis report.
- melis.balkaya@tubitak.gov.tr — Filed a preliminary incident report stating that a configuration error led to an incorrect CRL being served at the SSL CRL distribution point, that CRLWatch reported an issuer DN mismatch, and that the correct CRL was restored while a full incident report is being prepared.