Telekom Security: Failure in automatic issuance of CRLs

Telekom Security reported that automatic daily CRL issuance failed for multiple CA instances, leaving CRLs outdated for more than 24 hours. The initial report said the issue affected two CAs for four days, while the full incident report expanded this to three Sub CAs and stated that revoked certificates did not appear on a CRL within the required timeframe. The incident was discovered after a third party sent a Certificate Problem Report; OCSP was not affected. Telekom Security said issuance was restored and new CRLs were published, and later status updates said some action items were finished while others remained ongoing. The bug remains assigned, with Telekom Security planning another update on 2026-10-26.

1. 2026-09-22 Automated CRL generation failed, causing CRLs to stop updating for affected Sub CAs.
2. 2026-09-30 A third party sent a Certificate Problem Report that identified certificates not appearing on a CRL within 24 hours.
3. 2026-09-30 Automation of CRL issuance was restored and affected Sub CAs issued new CRLs.

1. 2026-10-01 Telekom representative — Filed a preliminary incident report stating that automatic daily CRL issuance did not work for four days and that the source of disclosure was a third party.
2. 2026-10-07 Telekom representative — Posted the full incident report, describing the affected Sub CAs, impact, timeline, and relevant policy references.
3. 2026-10-14 Telekom representative — Reported that Action Item #3 was finished and that Action Items #2 and #4 were still ongoing.
4. 2026-10-19 Telekom representative — Said the team was still working on Action Item #4 and would provide an update on 2026-10-26.