← SSL.com cases
Bugzilla #2077599
Ca Certificate Compliance
Incident
Self Reported Incident
Revocation Issue
Repository Issue
SSL.com incident: inconsistent published CRLs for one issuing CA
ASSIGNED
SSL.com
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
SSL.com reported an incident affecting the published CRLs for one TLS issuing CA. The problem was that revoked certificate serial numbers were intermittently missing from, or duplicated within, some CRLs. SSL.com said the issue affected only CRLs for Cloudflare TLS Issuing ECC CA 3 and that OCSP responses remained correct throughout. The company stated that the issue was identified after a third-party report, then investigated, corrected, and redeployed. SSL.com posted a preliminary incident report on 2026-10-02 and later posted the full incident report on 2026-10-16. The thread also references Bug 2029230 as the mass revocation event that preceded the CRL inconsistency.
Chronology
- SSL.com completed a mass revocation of 1.7 million certificates, including certificates issued by Cloudflare TLS Issuing ECC CA 3.
- The first CRL was published that dropped an unexpired revoked serial number.
- SSL.com received an email reporting a CRL entry missing or duplicated issue and began investigating.
- SSL.com generated and published a corrected CRL after deploying a configuration fix.
- SSL.com completed deployment on impacted and non-impacted servers and posted a preliminary incident report.
- SSL.com posted the full incident report.
Thread Activity
- SSL.com — SSL.com opened a preliminary incident report describing intermittent missing or duplicated revoked serial numbers in a published CRL and said a full report would follow.
- SSL.com — SSL.com posted the full incident report with the timeline, impact, and remediation details.
Participants
SSL.com
External References
Related Bugzilla IDs Mentioned
Similar Local Cases
SSL.com: MPIC not performed for specific DCV path
SSL.com: Test websites for EV enabled Roots with non-EV certificates
SSL.com: CRL URL typo in CRL URL disclosed to CCADB
SSL.com: Expired certificate for a “Valid” Test Website
SSL.com: Issuance of TLS certificates with domain validation methods prohibited by SC-45
SSL.com: Issuance of 1 EV TLS certificate using a Registration/Incorporation Agency not included in our approved public list.
SSL.com: Failure to process CAA records from one SubCA
SSL.com: Incorrect Open MPIC Lambda implementation by EJBCA ACME Service