SSL.com CCADB CRL URL disclosure mismatch and follow-up corrections
SSL.com reported that a CRL URL disclosed in CCADB for the subordinate CA Euronet TLS Issuing RSA CA 1 did not exactly match the CRL URL in certificates issued by that CA. The mismatch was a one-character hostname typo in the CCADB record, while the certificate’s CRL Distribution Points extension contained the correct URL. SSL.com corrected the CCADB record the same day it was identified, and later found additional CA records with incorrect CRL disclosures after running a validation job. The full incident report says the affected CCADB disclosures for all listed CAs were corrected, and that relying parties were not affected because the certificates contained the correct CRL URL and the CRL was available. SSL.com also posted action items to improve disclosure review and automated mismatch checking, with follow-up updates still pending.
- Earliest affected CA record date identified in the incident timeline.
- SSL.com received a CPR reporting a CCADB CRL URL mismatch for Euronet TLS Issuing RSA CA 1 and corrected the CCADB record the same day.
- A validation job found six additional CA records with mismatched CRL disclosures.
- SSL.com corrected the CCADB CRL disclosures for the six additional CAs.
- A later validation run found six more CAs with incorrect CRL disclosures, and SSL.com corrected them.
- SSL.com posted the full incident report.
- SSL.com said action items 1 and 2 were complete and requested the next update date be set to 2026-11-15.
- SSL.com — SSL.com posted a preliminary incident report describing the CCADB CRL URL mismatch and stating the source was a third-party report.
- SSL.com — SSL.com posted the full incident report, including the timeline, impact, and corrective actions.
- SSL.com — SSL.com said action items #1 and #2 were complete, action items #3 and #4 were in progress, and asked for the next update date to be set to 2026-11-15.