← Government of Hong Kong (SAR), Hongkong Post, Certizen cases
Bugzilla #2076994
Ca Certificate Compliance
Externally Reported Incident
Incident
Repository Issue
Hongkong Post CRL HTTP endpoints used legacy Content-Type application/x-pkcs7-crl
ASSIGNED
Government of Hong Kong (SAR), Hongkong Post, Certizen
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
This case concerns two Hongkong Post e-Cert CRL HTTP endpoints that returned the legacy HTTP Content-Type application/x-pkcs7-crl instead of the RFC 5280–recommended application/pkix-crl. The issue was first reported externally by email, and Hongkong Post treated it as a third-party reported incident. Hongkong Post acknowledged the report, investigated the configuration, and confirmed the finding as a long-standing legacy MIME mapping. The full incident report says the mapping was deployed in testing, and the planned remediation was to change the content type to application/pkix-crl after allowing time for relying parties to test. The bug remains ASSIGNED in the thread provided.
Chronology
- An external reporter observed two Hongkong Post CRL URLs returning Content-Type: application/x-pkcs7-crl.
- Hongkong Post received the report and began investigating the CRL media type configuration.
- The .crl mapping to application/pkix-crl was deployed across CRL hosts in the testing environment.
- Hongkong Post recommended changing the content type to application/pkix-crl in about one month.
Thread Activity
- Certizen representative — Posted a preliminary incident report saying an external report found two CCADB-disclosed CRL endpoints using application/x-pkcs7-crl instead of application/pkix-crl.
- Certizen representative — Said Hongkong Post was assessing whether there was any technical or operational justification for using x-pkcs7-crl and would report results in the next update.
- Certizen representative — Posted the full incident report with timeline, root cause analysis, and planned remediation to change the CRL media type.
Participants
Certizen representative
External References
Related Bugzilla IDs Mentioned
Similar Local Cases
DigiCert: CPR subject.countryName
eMudhra emSign PKI Services: Delegated OCSP Responder certificates containing cRLDistributionPoints extension
Telekom Security: Typographical error in CPS section 7.1.6
OISTE: Specific test websites for EV not listed in CCADB
SSL.com: Invalid Subject stateOrProvince Values
TunTrust: OCSP responder "Unknown" of one Pre-certificate
Consorci AOC: Non-BR-Compliant OCSP Responders
Firmaprofesional: certificateHold reasonCode entries in AC Firmaprofesional - CUALIFICADOS CRL