NetLock third-party reported CRL publication defect: same cRLNumber served with different CRL contents
This case concerns a third-party report that NetLock’s CRL service served different CRL contents under the same cRLNumber. The initial report said the root CA CRL at https://crl1.netlock.hu/index.cgi?crl=gold changed from 13 to 15 entries while keeping cRLNumber 39 and the same thisUpdate/nextUpdate values. NetLock said it received the report, investigated, and later filed a full incident report. In the full report, NetLock said that for most of its CAs the CRL service publishes two different CRLs with the same cRLNumber, one at the certificate URL and one at the CCADB-disclosed URL, and that neither has an Issuing Distribution Point. NetLock also said that on 2026-09-25 the Gold root CRL at a single URL changed contents while keeping cRLNumber 39, and that one CRL for NetLock Közjegyzői Eat. (Class A Legal) had no cRLNumber extension. The report states that no certificates were misissued and that issuance was not stopped because certificate issuance was not affected. The thread also notes related bugs 2075255 and 2075258 and identifies the issue as third-party reported.
- A Gold root CRL was issued with cRLNumber 39.
- A third party reported that the Gold root CRL at the same URL changed from 13 to 15 entries while keeping cRLNumber 39.
- NetLock filed its full incident report describing duplicate CRL versions under the same cRLNumber.
- Netlock — Roland posted a preliminary incident report saying a third party reported two different CRLs under the same cRLNumber and that NetLock was investigating.
- Netlock — Levente said the full incident report would be filed by 2026-10-10 12:00 UTC and noted this was the CRL publication defect referenced in bugs 2075255 and 2075258.
- Netlock — Levente filed the full incident report describing duplicate CRL versions under one cRLNumber and listing related incidents and action items.