KIR incident: Root CA CRL nextUpdate exceeded the 12-month limit
KIR reported that CRLs issued by two of its root CAs, SZAFIR ROOT CA3 TLS and SZAFIR ROOT CA5 SMIME, had a nextUpdate value more than 12 months after thisUpdate. The issue was first brought to KIR’s attention by a community member’s Certificate Problem Report about the SZAFIR ROOT CA3 TLS CRL, and KIR then found the same defect in the SZAFIR ROOT CA5 SMIME CRL. KIR said the non-compliance was limited to the CRL nextUpdate field and that the revocation information itself was correct. KIR issued replacement CRLs with conformant nextUpdate values on 2026-09-24 and later stated that the incident was remediated and all action items were complete. The closure report says KIR removed the grace period from the root CA configuration, adopted a configuration standard, and now lints CRLs before publication.
- First affected CRL was issued by SZAFIR ROOT CA3 TLS with nextUpdate beyond the 12-month limit.
- KIR received a Certificate Problem Report about the SZAFIR ROOT CA3 TLS CRL nextUpdate value.
- KIR issued replacement CRLs for both affected root CAs with corrected nextUpdate values.
- Kir representative — KIR opened a preliminary incident report describing the CRL nextUpdate non-compliance and stating that the issue was contained.
- Kir representative — KIR filed the full incident report, confirmed both root CAs were affected, and said the incident was remediated with all action items complete.
- Kir representative — KIR posted a closure summary describing the root cause, remediation, and request for closure.