← iTrusChina Co., Ltd. cases
Bugzilla #2077101
Ca Certificate Compliance
Incident
Self Reported Incident
Revocation Issue
Policy Document Issue
iTrusChina self-reports CRL profile compliance issues involving reused CRLNumber and missing NULL in CRL signatureAlgorithm
ASSIGNED
iTrusChina Co., Ltd.
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
iTrusChina opened this case to disclose two CRL compliance issues after being notified by a third-party Certificate Problem Report. The reported issues were reused CRLNumber values on consecutive CRLs for three issuing CAs, and a missing NULL parameter in the vTrus Root CA CRL signatureAlgorithm. iTrusChina said it began an internal investigation, completed root cause analysis, and prepared remedial actions. The thread states that the company updated the CRL generation program, updated the ARL generation program, generated new ARLs, and added conformity checks to periodic internal audits. The latest comment says all action items have been finished and the bug is being monitored for comments and questions.
Chronology
- A CRL generation program bug was introduced that later led to reused CRLNumber values.
- Manual CRL generation occurred for vTrus issuing CAs, followed by scheduled daily auto CRL generation.
- iTrusChina was notified by a third-party CPR about the two CRL issues.
- iTrusChina confirmed the issues and started its internal investigation.
- The team planned to deploy fixes and generate new ARLs.
- The CRL generation and ARL generation fixes were due to be completed.
- New ARLs were planned to be generated before this date.
Thread Activity
- iTrusChina Co., Ltd. — Reported a preliminary incident involving reused CRLNumber values and a missing NULL parameter, and said the issue was disclosed in response to a third-party CPR.
- iTrusChina Co., Ltd. — Said root cause analysis was finished and remedial actions were underway, with the full incident report to follow.
- iTrusChina Co., Ltd. — Filed the full incident report, described the two CRL issues, and linked them to BR 7.2.2 and BR 7.1.3.2.1.
- iTrusChina Co., Ltd. — Said all action items were finished and listed completed mitigation and prevention steps.
Participants
iTrusChina Co., Ltd.
External References
Similar Local Cases
iTrusChina: Inconsistent EKUs in CP/CPS and Mis-issuance of TLS Certificates with clientAuth against CP/CPS
iTrusChina: Failure to Provide Regular Incident Update
iTrusChina: Finding in Routine WebTrust Audit - Domain validation records without the TLS BR version
iTrusChina: Failure to Respond to Feb 2026 Chrome Root Program Survey
iTrusChina: verification errors for the roots' CRLs(ARL)
iTrusChina: OCSP Response ECDSA signatureAlgorithm with NULL parameters
Disig: CRL contains not allowed attributes
ANF: Potential TLS BR 7.1.2.8 violations in OCSP responder certificate