Asseco DS / Certum: Incomplete CRL disclosure in CCADB; incident report completed and closure pending
This case concerns Certum’s incomplete disclosure of CRL Distribution Point URLs in CCADB for the Certum Trusted Network CA root and related CA records. A third party reported that the CCADB entries listed only one full CRL URL even though issued certificates contained additional CRL Distribution Point URLs. Certum investigated and confirmed that the omitted URLs were functional and resolved to the same CRL object, so the issue was limited to incomplete CCADB disclosure rather than a certificate validation or revocation problem. Certum said it corrected the discrepancy, reviewed additional CCADB records, updated internal procedures and PKI change management, and extended its verification tooling. The full incident report was acknowledged as late, and Certum said it opened a separate incident for that delayed publication. Certum later posted a closure summary stating that all action items were complete, and CCADB issued a final call for comments saying the report would be closed around 2026-09-14.
- The CCADB requirement to disclose all CRL distribution point URLs for CA certificates took effect.
- A third party notified Certum that the CCADB record for the Certum Trusted Network CA root did not disclose all CRLDP URLs present in certificates.
- Certum identified additional certificates whose listed CRL URLs required updating.
- Certum reported that the tool enhancement, review of existing CCADB records, and procedure updates were complete.
- Certum submitted a report closure summary stating that all action items were completed.
- Assecods representative — Submitted a preliminary incident report saying the CCADB CRL URL disclosure was incomplete and that Certum would correct the discrepancy and verify other records.
- Asseco Data Systems S.A. — Filed the full incident report, confirming the incomplete CCADB disclosure, the investigation results, and the remediation timeline.
- Community commenter — Noted that the 14-day timeline starts on receipt of the Certificate Problem Report, not on completion of analysis.
- Assecods representative — Acknowledged the deadline was calculated incorrectly and said the Full Incident Report was late; also said a separate incident was opened for the delayed publication.
- Assecods representative — Said there were no updates on the bug.
- Assecods representative — Said there were no further updates and requested the next update date be set to 2026-08-31.
- Assecods representative — Reported that the action items were complete, including the tool enhancement, review of existing CCADB records, and procedure updates.
- Assecods representative — Posted a closure summary stating that the incident description, root causes, remediation, and all action items were complete and requesting closure.
- CCADB representative — Posted a final call for comments or questions and said the incident report would be closed around 2026-09-14.