DigiCert: Incomplete disclosure of CRL URLs in CCADB; incident report closed and bug resolved
This case concerns DigiCert’s incomplete disclosure of CRL URLs in CCADB for a set of DigiCert CAs. The issue was first reported by a third party on 2026-07-14, and DigiCert’s investigation found 15 additional affected CAs beyond the two initially reported, for a total of 17 affected CAs. DigiCert said the problem was a CCADB synchronization error tied to legacy owner metadata and a policy/process gap, and that revocation information at the disclosed URLs remained accurate and available. DigiCert updated the affected CCADB disclosures on 2026-07-14 and 2026-07-23, deployed automation improvements on 2026-07-21, and later reported that all five action items were complete. DigiCert submitted a closure summary on 2026-08-09, CCADB issued a final call for comments, and the bug is now marked RESOLVED with resolution FIXED.
- The first known deviation between CCADB-reported CRLDPs and leaf certificates began.
- A third party reported undisclosed CRLs in two certificates, and DigiCert updated the initial CRLDP disclosures.
- DigiCert deployed additional automation improvements for CRLDP handling.
- DigiCert updated the remaining CRLDP disclosures in CCADB.
- DigiCert submitted a closure summary stating that all five action items were complete.
- DigiCert — DigiCert filed a preliminary incident report saying the CCADB-disclosed CRL URLs were not comprehensive and citing CCADB Policy Section 6.2.
- DigiCert — DigiCert said it was preparing its full incident report and would post it on or before 2026-07-26.
- DigiCert — DigiCert posted its full incident report, described the issue as a CCADB synchronization error, and said the incident was not delayed revocation.
- DigiCert — A dossier attachment was created for the bug.
- DigiCert — DigiCert said it had completed Action Items #3, #4, and #5 and noted related CCADB policy/API discussions in CA/Browser Forum venues.
- DigiCert — DigiCert filed a report closure summary stating that all five action items were complete and requesting closure.
- CCADB representative — CCADB issued a final call for comments or questions and said the incident report would be closed around 2026-08-17.