Apple: CRL signed with the wrong ECDSA hash algorithm
Apple reported that one of its CRLs was signed with ecdsa-with-SHA384 when, because the signing key is P-256, it should have been signed with ecdsa-with-SHA256 under Baseline Requirements section 7.1.3.2.2. Apple said the affected CRL was for Apple Public EV Server ECC CA 1 - G1 and that the issue did not affect any certificates. In its full incident report, Apple said it corrected the CRL and issued a new one, and that issuance of leaf certificates was not stopped because the problem did not impact them. Apple also stated that there was no revocation delay. The report says the issue was discovered after DigiCert received a Certificate Problem Report from a community member and notified Apple. Apple later said all action items were completed and that, if there were no further questions, its next update would be a closure report.
- Baseline Requirements version 1.7.1 became effective, requiring ecdsa-with-SHA256 on P-256 curves.
- A Certificate Problem Report was received about the CRL signature algorithm issue.
- Apple corrected the CRL and issued a new one.
- Apple representative — Apple filed a preliminary incident report describing the CRL signature mismatch and said DigiCert had been notified through a certificate problem report.
- Apple representative — Apple said it was still monitoring the incident and would post the full report by October 9, 2026.
- Apple representative — Apple posted the full incident report, including the timeline, impact, root cause analysis, and related incidents.
- Apple representative — Apple said all action items were completed and that its next update would be a closure report if there were no further questions.