Asseco DS / Certum: HTTP 404 returned by CRL Distribution Point URLs for six pre-inclusion Root CAs
The Certum Compliance Team opened this bug after becoming aware of a third-party report about six CRL Distribution Point URLs that currently return HTTP 404. The report raised a concern that the presence of these URLs in CCADB may be inconsistent with CCADB Policy. The affected root CAs are described as being in a pre-inclusion phase: they have not yet been submitted to any Root Program for inclusion and are not currently trusted by any Root Store. The team stated that, as part of its internal rollout process, CCADB records are created before Root Inclusion Requests are submitted, while the CRL infrastructure is scheduled to become operational before the roots are submitted for public trust. Based on its assessment to date, the team said it has not identified evidence of non-compliance with the CA/Browser Forum Baseline Requirements or CCADB Policy. The team is documenting the report and reviewing whether changes to its deployment process or the timing of populating CCADB records would improve clarity and avoid similar reports in the future.
- Certum Compliance Team became aware of a third-party report that six CRL Distribution Point URLs return HTTP 404 while the related root CAs are in pre-inclusion.
- kateryna.aleksieieva@assecods.pl — Opened a preliminary incident report describing the 404-returning CRL URLs, the third-party concern about CCADB consistency, and stated no evidence of CCADB/BR non-compliance was found so far while reviewing process/timing changes.