Telia self-reported CRL signature algorithm non-conformance for EC issuer keys
Telia reported a CRL signature algorithm non-conformance affecting several EC PKIs, after a third-party Certificate Problem Report was received on 2026-09-23. The issue was that CRLs for EC-384 issuer keys were signed with `ecdsaWithSHA256` and had an `AlgorithmIdentifier` `parameters` value of `NULL`, which Telia said violated RFC 5758 section 3.2 and related Baseline Requirements and CP/CPS requirements. Telia stated that the affected PKIs included Telia EC TLS Root CA v3, Telia EC TLS DV CA v4, Telia EC Email Root CA v3, Telia EC Client Root CA v3, and Telia EC Signing Root CA v3. Telia said the issue was identified in internal review after the CPR, remedial actions were completed, and updated CRLs were generated; it also said no certificates were affected. The thread shows Telia continuing to track action items, including amending CA ceremony documentation to explicitly verify CRL signature settings, with that item marked completed in the latest update.
- Affected self-signed root CAs were issued with incorrect CRL signature algorithm settings.
- A third-party Certificate Problem Report was received about the CRL issue.
- Telia posted a preliminary incident report in Bugzilla.
- Telia posted the full incident report with timeline, impact, and remediation details.
- Telia reported completion of the documentation update action item and said one open action item remained.
- Teliacompany representative — Telia filed a preliminary incident report describing the CRL signature algorithm and `parameters`-field issue and said it would submit a full report later.
- Teliacompany representative — Telia said it had completed remedial actions, updated CA software, regenerated CRLs, and would correct a timing inaccuracy in the full report.
- Teliacompany representative — Telia filed the full incident report, including the timeline, impact statement, and remediation steps.
- Teliacompany representative — Telia said the CA ceremony documentation had been amended and that the corresponding action item was completed.