DigiCert expired CRL published past nextUpdate after publishing pipeline migration issue
DigiCert reported that a third party found an issuing CA CRL endpoint serving a recently expired CRL for DigiCertG5TLSRSA4096SHA3842021CA1. DigiCert said a new CRL had been generated on schedule, but an in-progress software migration disrupted the publishing and alerting processes, leaving the stale CRL published for about 4 to 5 hours. The incident affected CRL availability at two distribution points; OCSP and certificate issuance were not impacted. DigiCert later filed a full incident report, described the non-compliance window, and said it completed the action items, including adding alerting at the retrieve point. The thread also includes discussion about whether the new monitoring covered this endpoint and DigiCert’s explanation that the migration affected monitoring in an unanticipated way. The bug remains assigned, and no closure is shown in the thread.
- A CRL for DigiCert G5 TLS RSA4096 SHA384 2021 CA1 was generated on schedule but remained published past its nextUpdate at two CRL distribution points.
- DigiCert opened the bug with a preliminary incident report describing the expired CRL and the publishing/alerting disruption.
- DigiCert filed a full incident report stating the CRL stayed past nextUpdate for about 4 hours and 48 minutes and that the issue was isolated to CRL publishing.
- DigiCert said it had completed Action Item #2, adding alerting at the retrieve point.
- DigiCert — DigiCert reported that a third party found an expired CRL being served and said the stale CRL was published for about 4 hours due to a migration-related disruption.
- CCADB representative — Bug 2073230 was marked as a duplicate of this bug.
- DigiCert — DigiCert said it would file a full incident report by 2026-09-29.
- DigiCert — DigiCert filed the full incident report, gave the non-compliance window, and listed the relevant policy sections.
- DigiCert — DigiCert requested a next update date of 2026-10-12 for Action Item #2.
- DigiCert — DigiCert said Action Item #2 was complete and that it would prepare a closing summary.
- Community commenter — A commenter asked why prior monitoring commitments had not detected the issue and cited earlier DigiCert bugs.
- DigiCert — DigiCert said the earlier monitoring commitments were implemented, explained that the migration affected monitoring and alerting, and said it would reflect that in the closing summary.
- Community commenter — A commenter asked for clarification about which systems and endpoints were covered by the prior monitoring commitments and how the scope was validated.