Telekom Security / DFN: CRL crlEntryExtensions zero-length SEQUENCE non-compliance
This case concerns a CRL non-compliance in the DFN-operated hierarchy under Telekom Security’s root. The incident report says CRLs issued by DFN contained a zero-length crlEntryExtensions SEQUENCE in revokedCertificates entries when no reason code was present, which violates RFC 5280. The issue was third-party reported, and the full incident report states that issuance for the affected PKI hierarchy had already stopped on 2023-08-31 because the hierarchy will be discontinued. Telekom Security said DFN would submit the full incident report because the non-compliance originated from an externally operated sub-CA, while Telekom Security remained responsible as root CA and continued working with DFN. The thread later recorded remediation action items, including creating a software fix, publishing a compliant CRL, and checking for similar errors, all of which were marked completed by 2026-10-20.
- DFN’s CRL generation process began producing revokedCertificates entries with zero-length crlEntryExtensions when no reason code was given.
- Issuance for the affected PKI hierarchy stopped.
- A certificate problem report was sent to Telekom Security about the CRL issue.
- DFN submitted the full incident report describing the RFC 5280 non-compliance.
- DFN reported completion of the remaining action item and said no similar errors were found.
- Telekom representative — Opened a preliminary incident report describing the zero-length crlEntryExtensions issue and noting it was third-party reported.
- Telekom representative — Explained that DFN would submit the full incident report because the non-compliance originated from an externally operated sub-CA, while Telekom Security remained responsible as root CA.
- Dfn-cert representative — Submitted the full incident report, including timeline, impact, related incidents, and root cause analysis.
- Dfn-cert representative — Requested the Next Update field be set to 2026-10-23 for the remaining open action item.
- Dfn-cert representative — Reported completion of the remaining action item and listed all action items as completed.