Asseco DS / Certum: Incomplete CRL disclosure in CCADB, with late full incident report noted
This case concerns Certum’s incomplete disclosure of CRL Distribution Point URLs in CCADB for the Certum Trusted Network CA root. A third party reported that the CCADB record listed only one full CRL URL even though certificates issued under the CA contained additional CRL Distribution Point URLs. Certum investigated and confirmed that the omitted URLs were functional and resolved to the same CRL object, so the issue was limited to incomplete CCADB disclosure rather than a certificate validation or revocation problem. Certum said it corrected the discrepancy and checked whether other CA records had the same issue; its full incident report also identified additional CCADB records that needed updates. Certum later acknowledged that the Full Incident Report was submitted after the applicable deadline and said it opened a separate incident for the delayed publication. The bug remains assigned, and the latest update requested a next update date of 2026-08-31.
- The CCADB requirement to disclose all CRL distribution point URLs for CA certificates took effect.
- A third party notified Certum that the CCADB record for the Certum Trusted Network CA root did not disclose all CRLDP URLs present in certificates.
- Certum identified additional certificates whose listed CRL URLs required updating.
- Certum acknowledged that the Full Incident Report was submitted after the applicable deadline and said it opened a separate incident for the delayed publication.
- Assecods representative — Submitted a preliminary incident report saying the CCADB CRL URL disclosure was incomplete and that Certum would correct the discrepancy and verify other records.
- Asseco Data Systems S.A. — Filed the full incident report, confirming the incomplete CCADB disclosure, the investigation results, and the remediation timeline.
- Community commenter — Noted that the 14-day timeline starts on receipt of the Certificate Problem Report, not on completion of analysis.
- Assecods representative — Acknowledged the deadline was calculated incorrectly and said the Full Incident Report was late; also said a separate incident was opened for the delayed publication.
- Assecods representative — Said there were no updates on the bug.
- Assecods representative — Said there were no further updates and requested the next update date be set to 2026-08-31.