Certum third-party report on incorrect ECDSA-SHA384 AlgorithmIdentifier encoding in CRLs

Certum reported that it received third-party Certificate Problem Reports about incorrect encoding of the ECDSA-SHA384 AlgorithmIdentifier in 15 CRLs. The affected CRLs included an unnecessary NULL parameters value in both the tbsCertList signature field and the outer signatureAlgorithm field. Certum said the issue affected CRLs published through 15 distribution points and that the CRL generation implementation was corrected on 2026-09-29. It then regenerated, republished, and verified all affected CRLs. The report states that certificate issuance was not stopped because the issue was limited to CRL encoding and did not affect certificate generation. Certum also noted that this incident does not involve delayed certificate revocation.

1. 2020-08-20 Baseline Requirements 1.7.1 made the required ECDSA signature AlgorithmIdentifier encoding applicable to CRLs.
2. 2026-09-23 Third-party CPRs identified incorrect ECDSA-SHA384 AlgorithmIdentifier encoding in 15 Certum CRLs.
3. 2026-09-29 Certum corrected the CRL generation implementation and republished the affected CRLs with the required encoding.

1. 2026-09-24 Assecods representative — Certum opened a preliminary incident report describing the third-party CPRs, the affected CRLs, and the incorrect AlgorithmIdentifier encoding.
2. 2026-10-07 Assecods representative — Certum filed the full incident report with the timeline, remediation details, and related policy references.
3. 2026-10-14 Assecods representative — Certum said it had no further updates and requested the next update date be set to 2026-11-30.