Actalis self-reported TLS certificate profile errors affecting CRL Distribution Point and AIA URLs
Actalis is tracking a self-reported incident involving TLS server subscriber certificates that were issued with incorrect cRLDistributionPoints references, and later found to also have incorrect authorityInfoAccess URLs. The issue was first identified while Actalis was investigating a third-party report about a potentially undisclosed CRL in CCADB, but Actalis said the CCADB disclosures themselves were correct. Actalis corrected the affected certificate profiles, did not suspend issuance, and revoked all affected certificates by 2026-08-31. The full incident report states that 6,074 certificates were affected in total and that no valid affected certificates remained. In the latest update on 2026-10-20, Actalis said it released the Certificate Profile Validation Matrix and deployed updates to both the pre-issuance linters and the post-issuance linter, completing Action Items 3 and 6. The bug remains open and assigned, with remaining action items still being tracked in the thread.
- The first affected TLS server certificate was issued with incorrect CDP/AIA profile data.
- Actalis identified the certificate-profile errors while investigating a third-party report.
- Actalis completed revocation of all affected certificates.
- Actalis posted the full incident report and attached the affected certificate list.
- Actalis released the Certificate Profile Validation Matrix and deployed linter updates to prevent and detect non-compliant certificates.
- Staff representative — Actalis filed a preliminary self-reported incident report describing the incorrect CRL Distribution Point issue, the affected certificate counts, and the plan for a full incident report.
- Staff representative — Actalis said all affected certificates had been revoked and that the complete corpus and timeline would be included in the final report.
- Staff representative — Actalis posted the full incident report, including the CDP and AIA errors, the timeline, impact, and confirmation that all affected certificates were revoked.
- Staff representative — Actalis provided a weekly update saying progress was aligned with scheduled action items.
- Staff representative — Actalis supplied missing evaluation-criteria text for the full incident report and said progress remained aligned with scheduled action items.
- Staff representative — Actalis said the production rollout of the automated solution for Action Item 3 had been delayed by a few days and rescheduled completion to 2026-10-09.
- Staff representative — Actalis said the rollout for Action Item 3 was further delayed and consolidated into a broader release package, with deployment rescheduled to 2026-10-30.
- Staff representative — Actalis said progress remained aligned with the scheduled action items.
- Staff representative — Actalis rescheduled the completion date for Action Item 5 to 2026-10-30 for further analysis of internal alerting mechanisms.
- Staff representative — Actalis said it released the Certificate Profile Validation Matrix and deployed updates to the pre-issuance and post-issuance linters, completing Action Items 3 and 6.