Certum: incomplete CRL URL disclosures in CCADB records
This case concerns Certum’s disclosure of CRL URLs in CCADB for eight CA certificate records. A third-party Certificate Problem Report on 2026-09-23 identified that six subordinate CA records had CCADB CRL URLs that did not match the CRL Distribution Point URLs in the certificates. Certum said it reviewed the affected records, corrected the six reported records on 2026-09-24, and then found two additional affected Code Signing CA records during expanded verification, which it corrected on 2026-09-29. Certum stated the issue was limited to incomplete CRL disclosure information maintained in CCADB and did not affect certificate issuance or certificate contents. The bug remains assigned, and Certum requested the next update date be set to 2026-11-30 for the remaining action item.
- CCADB CRL URL disclosure requirements became effective for applicable CA certificate records.
- A third-party CPR identified incorrect CRL URL disclosures in six Certum subordinate CA records.
- Certum corrected the six reported CCADB records.
- Certum found and corrected two additional affected Code Signing CA records during expanded verification.
- Assecods representative — Certum opened a preliminary incident report describing incorrect CRL disclosures in CCADB for six subordinate CAs and said it was reviewing the affected records.
- Assecods representative — Certum filed a full incident report stating the final scope was eight CCADB CA certificate records and that the issue was limited to CCADB disclosure data.
- Assecods representative — Certum corrected the appendix to include the two Code Signing CA records in the final scope.
- Assecods representative — Certum said it had no further updates and requested the next update date be set to 2026-11-30.