NETLOCK third-party Certificate Problem Report about CRL reasonCode 0 entries
This case is a third-party Certificate Problem Report about NETLOCK CRLs containing revoked-certificate entries with an explicit reasonCode of unspecified (0), which the Baseline Requirements say must be omitted instead. NETLOCK said it received the report, sent a preliminary reply within 24 hours, and filed a preliminary incident report in this bug. The initial report named several affected issuing CAs, and NETLOCK later corrected the scope and said the issue affected additional CAs in the same hierarchy. NETLOCK’s full incident report said the problem was still ongoing, described it as a repeat of Bug 2011314, and stated that the root cause was automatic revocation at the end of a suspension period writing reasonCode 0. NETLOCK later reported that a fix had passed tests, was not yet in production, and would be rolled out by 2026-10-16 with interim mitigation in place until then.
- A third party reported CRL entries with reasonCode unspecified (0) in NETLOCK CRLs.
- NETLOCK sent a preliminary reply and filed a preliminary incident report.
- NETLOCK expanded the affected scope after verifying additional CRLs.
- NETLOCK filed a full incident report describing the ongoing CRL reasonCode defect.
- NETLOCK said the fix had passed tests but was not yet in production.
- Netlock — NETLOCK filed a preliminary incident report saying a third party reported CRL entries with reasonCode unspecified (0) and that a full report would follow.
- Netlock — NETLOCK said its own verification showed the affected-CA list was incomplete and that a full incident report would be filed by 2026-10-08.
- Community commenter — The reporter said Netlock were conflating two separate CPRs and noted this was a recurrence of Bug 2011314.
- Netlock — NETLOCK corrected the record, separated the two CPR timelines, and said the full incident report remained due on 2026-10-08.
- Netlock — NETLOCK said the full incident report would instead be filed by 2026-10-10 12:00 UTC and corrected an earlier comment about the related CRL publication defect.
- Community commenter — The reporter said the full incident report was overdue and asked for a human review of the incident reporting requirements.
- Netlock — NETLOCK filed the full incident report, described the issue as ongoing, and said remediation was in progress.
- Netlock — NETLOCK said the fix had passed tests, was not yet in production, and would be rolled out by 2026-10-16.