NAVER Cloud Trust Services: Missing CRL disclosure in CCADB for two subordinate CAs
NAVER Cloud Trust Services reported that two subordinate CA records in CCADB were missing the CRL disclosure required by CCADB Policy Section 6.2. The issue affected NAVER Cloud Trust Services G1 ECC CA4 and G1 RSA CA4, both of which had been issued but had not yet issued any certificates. A community member reported the problem, and NAVER corrected both records by entering [""] in the "JSON Array of Partitioned CRLs" field. In its full report, NAVER also identified the same disclosure issue on two older subordinate CA records, G1 ECC CA2 and G1 RSA CA2, which had already been revoked. NAVER said no certificates were affected and that the incident was contained to the CCADB records. The company later completed action items to update its internal CA creation checklist and its procedure for reviewing new CCADB policy versions. The bug remained assigned and the thread ended with a final call for comments before closure.
- CCADB Policy Version 2.1 takes effect, adding the requirement to enter [""] for a CA with no issued certificates.
- NAVER Cloud Trust Services G1 ECC CA2 and G1 RSA CA2 are revoked.
- NAVER Cloud Trust Services G1 ECC CA4 and G1 RSA CA4 are disclosed in CCADB with empty CRL fields.
- A community member reports the missing CRL disclosure for the CA4 records.
- NAVER corrects both CA4 records in CCADB by entering [""] in the partitioned CRL field.
- NAVER identifies the same CRL disclosure issue on the revoked CA2 records during root cause analysis.
- NAVER completes the remaining action items and requests closure of the incident report.
- Navercorp representative — NAVER filed a preliminary incident report describing missing CCADB CRL disclosures for two subordinate CAs and said the records were corrected after a community member report.
- Navercorp representative — NAVER posted the full incident report, added the two older revoked CA records to the scope, and described the timeline, impact, and root cause.
- Navercorp representative — NAVER reported completion of the remaining action items, including checklist and policy-review procedure updates.
- Navercorp representative — NAVER requested closure and stated that all disclosed action items had been completed.
- CCADB representative — CCADB issued a final call for comments and said the bug would be closed if no further questions were raised.