← Disig, a.s. cases
Bugzilla #2075878
Ca Certificate Compliance
Incident
Self Reported Incident
Repository Issue
Disig self-reported CRL non-compliance in CA Disig Root R2
ASSIGNED
Disig, a.s.
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Disig reported a non-compliant CRL for its legacy CA Disig Root R2. The issue was that the CRL contained prohibited authorityCertIssuer and authorityCertSerialNumber fields in the authorityKeyIdentifier extension, which Disig said violated TLS BR section 7.2.2. Disig stated that the problem was identified after a third-party report, then investigated internally, paused automated CRL generation for the affected profile, and updated the production CRL profile. The company later said a compliant CRL was issued, a zlint issue was opened and fixed, and all action items were completed. Disig requested closure of the incident in its final report.
Chronology
- CA Disig Root R2 was deployed with default RFC 5280 CRL profile settings.
- The TLS BR v2.0.1 mandatory CRL requirements took effect.
- Disig was notified about a non-compliant CRL for CA Disig Root R2.
- The CRL profile was updated and a compliant CRL was generated and published.
Thread Activity
- Disig, a.s. — Disig filed a preliminary incident report saying a third party had reported a non-compliant CRL and that further investigation was ongoing.
- Disig, a.s. — Disig said the internal investigation was ongoing and that its other CAs were okay.
- Disig, a.s. — Disig posted a full incident report describing the CRL non-compliance, impact, timeline, and remediation.
- Disig, a.s. — Disig said it had opened a zlint issue to address the detection gap.
- Disig, a.s. — Disig said the patch fixed the issue and the action item was completed.
- Disig, a.s. — Disig posted a closure summary stating remediation was complete and requesting closure.
Participants
Disig, a.s.
External References
Related Bugzilla IDs Mentioned
Similar Local Cases
Disig: Multi-purpose Subordinate CA with missing EKU
Disig: Non-BR-Compliant Certificate Issuance
Disig: Delayed Full Incident Report
Disig: Certificates with invalid embedded SCT signature
certSIGN: Missing the countryName attribute in the Subject DN of a test DV TLS certificate
Certigna: CRL HTTP Media Type
ANF: Potential TLS BR 7.1.2.8 violations in OCSP responder certificate
Microsoft PKI Services: OCSP Non-Compliance