NETLOCK third-party reported CCADB CRL URL disclosure mismatch
This case is a third-party Certificate Problem Report about NETLOCK certificates whose CRL Distribution Point URLs were not disclosed in CCADB for the issuing CAs. NETLOCK confirmed that the disclosure failure was real and that the affected set was larger than the original report, covering URLs used by NETLOCK Trust EV CA 3 and NETLOCK Trust Qualified EV CA 3. The company said the URLs had been present in issued certificates for some time and were not disclosed within the CCADB Policy §6.2 timeframe. NETLOCK also noted that one related CRL URL disclosed for another CA returned HTTP 404, and it said a separate incident had been filed for an inconsistent CRL issue found during verification. The bug remained open while NETLOCK prepared and then posted its full incident report, and it stated that CCADB disclosure correction was still in progress.
- A third party reported that NETLOCK-issued certificates contained CRL Distribution Point URLs not disclosed in CCADB.
- NETLOCK filed a preliminary incident report and said it was investigating the disclosure failure.
- NETLOCK confirmed the disclosure failure, identified additional undisclosed CRL URLs, and said CCADB correction was in progress.
- NETLOCK stated the undisclosed URLs were still not disclosed and that the full incident report would follow.
- NETLOCK posted the full incident report describing the CCADB disclosure mismatch and related findings.
- Netlock — Roland opened a preliminary incident report saying a third party reported undisclosed CRL URLs in CCADB and that NETLOCK was investigating.
- Netlock — Levente confirmed the disclosure failure, added another undisclosed URL, and said the CCADB correction would be completed by 2026-09-29.
- Community commenter — Wayne asked where the related incident had been filed and noted this was a recurrence of bug 2001327.
- Netlock — Levente identified bug 2075720 as the related inconsistency issue, said the earlier date had been missed, and stated the undisclosed URLs were still not disclosed.
- Community commenter — Wayne said the full incident report was overdue and asked for a human review.
- Netlock — Levente posted the full incident report, described the affected CAs and URLs, and listed related bugs 2001327, 2075720, 2075255, 2007948, and 2007116.