Actalis self-reported incorrect CRL Distribution Point references in TLS server certificates

Actalis opened this case as a preliminary incident report after identifying that some TLS server subscriber certificates contained incorrect cRLDistributionPoints references. The issue was first noticed while Actalis was investigating a third-party report about a potentially undisclosed CRL in CCADB, but Actalis states the CRL disclosure itself was correct. Actalis said the affected profiles were corrected immediately and that issuance was not suspended, so later certificates were not affected. The company identified 4,688 affected certificates across several TLS server profiles and said the affected certificates were subject to revocation under the Baseline Requirements and its CP/CPS. On 2026-09-01, Actalis reported that all affected certificates had been revoked. Actalis said a full incident report would be posted by 2026-09-10.

1. 2026-08-25 Actalis received a third-party report about a potentially undisclosed CRL in CCADB.
2. 2026-08-27 Actalis identified TLS server certificates with incorrect cRLDistributionPoints references to the wrong CRL service.
3. 2026-09-01 Actalis reported that all affected certificates had been revoked.

1. 2026-08-27 Staff representative — Actalis filed a preliminary incident report describing the incorrect CRL Distribution Point issue, the affected certificate counts, and the plan for a full incident report.
2. 2026-09-01 Staff representative — Actalis said all affected certificates had been revoked and that the full corpus and timeline would be included in the final report.