D-TRUST: Incomplete disclosure of CRL URLs in CCADB records
This case concerns D-TRUST’s incomplete disclosure of required CRL URLs in CCADB records for affected root and subordinate CA certificates. It was triggered by an external Certificate Problem Report on 2026-07-13 stating that HTTP URLs in the certificates’ crlDistributionPoints extensions were missing from the corresponding CCADB fields. D-TRUST confirmed the disclosure gap, said certificate validity was not affected, and stated that no revocation was required. The company corrected the affected CCADB records by 2026-07-31 and then spent the remainder of the thread documenting remediation and control improvements. As of the latest update, D-TRUST reported that all listed action items were complete and requested closure of the incident report. The bug remains assigned and i**********g@ccadb.org posted a final call for comments with closure expected around 2026-10-13.
- CCADB Policy Version 2.1 took effect with updated CRL disclosure requirements.
- An external report identified missing CRL URL disclosures in CCADB records.
- D-TRUST corrected the affected subordinate CA CCADB entries.
- D-TRUST corrected the root CA entries through a CCADB support case.
- D-TRUST revised the incident report and corrected the affected-record count to 30.
- D-TRUST completed the incident-report verification action item.
- D-TRUST completed the reconciliation-controls action item.
- D-TRUST submitted a closure summary requesting bug closure.
- Bdr representative — Submitted a preliminary incident report confirming the missing CCADB CRL URLs, stating no revocation was required, and saying a full incident report would follow.
- D-Trust — Posted the full incident report describing the affected CCADB entries, root cause, timeline, and action items.
- D-Trust — Reported that a support case was opened with CCADB so the root CA entries could also be corrected.
- D-Trust — Posted a revised incident report, corrected dates and action-item status, said the root CA entries were corrected through the CCADB support case, and requested the Next update field be set to 2026-10-01.
- Bdr representative — Said the full incident report still did not meet the expected standard and asked D-TRUST to revise it with a more complete root cause analysis and updated corrective, preventive, and detective actions.
- D-Trust — Posted a revised full incident report stating the corrected affected-record count was 30 and explaining the updated CCADB Policy 2.1 disclosure requirement.
- D-Trust — Reported that Action Item #1 was complete, while Action Items #2 and #4 remained open.
- D-Trust — Reported that Action Item #4 was complete after implementing a mandatory incident-report verification step.
- D-Trust — Reported that Action Item #2 was complete after expanding reconciliation controls to validate complete data sets.
- D-Trust — Posted a closure summary stating the incident was resolved, all action items were complete, and closure was requested.
- CCADB representative — Issued a final call for comments or questions and said the incident report would be closed around 2026-10-13.