Kamu SM: Missing CRL disclosure on a cross-signed CA record in CCADB
Kamu SM reported a CCADB compliance issue involving a missing CRL disclosure on the cross-signed certificate record for "TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 2" (CCADB ID A012563). The issue was identified after a third-party Certificate Problem Report on 2026-09-25, and Kamu SM said the applicable CRL URL was already disclosed on the corresponding self-signed Surum 2 record. Kamu SM stated that the cross-signed record was not updated within the CCADB Policy 6.2 timeframe after the relevant CRL became established when the Surum 3 subordinate CA was generated under the Surum 2 key. The company updated the affected CCADB record on 2026-09-26 and later updated its certificate generation checklist to require CRL URL verification across all records for a CA key, including cross-signed records. The report states that no certificate was misissued and that CRL publication itself was not affected. The bug was resolved as fixed.
- The cross-signed Surum 2 CA certificate record was created in CCADB.
- The Surum 3 subordinate CA was generated under the Surum 2 key, establishing the applicable CRL URL disclosure requirement.
- The seven-day CCADB Policy 6.2 deadline for disclosing the CRL URL on the cross-signed record elapsed.
- A Certificate Problem Report was received about the missing CRL disclosure.
- Kamu SM updated CCADB record A012563 with the applicable CRL URL.
- Kamu SM updated its CA certificate generation checklist to require CRL URL entry on all CCADB records for a CA key.
- Tubitak representative — Kamu SM filed a preliminary incident report saying a third-party CPR identified a missing CRL disclosure on the cross-signed Surum 2 CCADB record and that the record was updated after review.
- Tubitak representative — Kamu SM filed the full incident report describing the CCADB Policy 6.2 non-compliance, the timeline, and the remediation steps.
- Tubitak representative — Kamu SM posted a closure summary stating the action items were complete and requesting closure.
- CCADB representative — CCADB issued a final call for comments and said the report would be closed around 2026-10-12 if there were no further questions.