Certigna incident report: CRL HTTP media type non-compliance
Certigna filed a self-reported incident about its CRL publication service serving CRLs over HTTP with the media type application/x-pkcs7-crl instead of application/pkix-crl as required by RFC 5280 section 4.2.1.13. The report says the non-compliant configuration had been in place since 2007-06-29 and was identified on 2026-09-30 after a third party reported it. Certigna states it corrected the configuration the same day and then completed follow-up action items to integrate CRL-watch into monitoring and update monitoring procedures. The closure summary says all disclosed action items were completed and the company requested closure. A commenter later noted that the update about completed action items may not have been posted within three days of the change, citing CCADB update guidance.
- Certigna configured its CRL publication service to use the media type application/x-pkcs7-crl.
- A third party reported the CRL media type issue and Certigna corrected the publication service to use application/pkix-crl.
- Certigna posted a closure summary stating that all action items were completed and requested closure.
- Dhimyotis representative — Certigna opened a full incident report describing the CRL media type non-compliance and listed remediation action items.
- Dhimyotis representative — Certigna posted an action-item update showing the mitigation, detection, and prevention items as complete and requested closure.
- CCADB representative — CCADB posted a final call for comments and said the report would be closed on or about 2026-10-14.
- Community commenter — A commenter said the action-item completion update appeared to be late under CCADB guidance requiring updates within three days of an action item being changed or completed.
- Dhimyotis representative — Certigna replied by quoting the CCADB update guidance and linking a related ticket, while reiterating that all action items had been completed.