Chunghwa Telecom: Incomplete disclosure of CRL URLs in CCADB; report closed
This case concerns Chunghwa Telecom’s incomplete disclosure of CRL Distribution Point URLs in CCADB for one of its CAs. A third party reported that the CCADB record did not include the full set of partitioned CRL URLs appearing in issued certificates. Chunghwa Telecom investigated, confirmed the CCADB Policy Section 6.2 violation, and updated the affected CCADB record on 2026-07-13 to add the missing partitioned CRL URLs. It later reported that the corrective and preventive actions were complete, including a mandatory four-eyes review process and compliance awareness training. On 2026-08-14, Chunghwa Telecom submitted a closure summary requesting closure, and CCADB issued a final call for comments with a stated plan to close the report on or about 2026-08-21. The bug is now RESOLVED with FIXED resolution.
- CCADB Policy 2.0 took effect, marking the start of the non-compliance period described in the report.
- Chunghwa Telecom identified the incomplete CRL URL disclosure and updated the CCADB record with the missing partitioned CRL URLs.
- Chunghwa Telecom published the full incident report in Bugzilla.
- Chunghwa Telecom marked the CCADB update, four-eyes review process, and training items as complete.
- Chunghwa Telecom submitted a closure summary requesting closure of the incident report.
- The bug was resolved with FIXED resolution.
- Cht representative — Filed a preliminary incident report saying the CCADB CRL URL disclosure was incomplete and that a full report would follow.
- Cht representative — Submitted the full incident report, confirmed the CCADB policy violation, described the missing partitioned CRL URLs, and noted the CCADB record was updated.
- Cht representative — Posted an action-items update showing the CCADB update, four-eyes review, and training items as complete.
- Cht representative — Said Chunghwa Telecom was monitoring the bug and had no new information.
- Cht representative — Posted a report closure summary stating that all corrective and preventive actions were complete and requesting closure.
- CCADB representative — Issued a final call for comments or questions and said the report would be closed on or about 2026-08-21.