Self-reported incident: incorrect AIA accessMethod in NAVER Cloud Trust Services cross-certificate
NAVER Cloud Trust Services reported a compliance incident involving a cross-certificate for NAVER Cloud Trust Services RSA Root G1. The issue was found during a self-initiated internal review of certificates in its repository on 2026-10-10. The certificate’s AIA extension was encoded incorrectly: both AccessDescription entries used id-ad-ocsp, when the second entry should have used id-ad-caIssuers for the issuing CA certificate URL. NAVER said the URL itself was correct, the ECC cross-certificate from the same ceremony was correct, and no subscriber certificates were affected. The company stated that one older RSA cross-certificate had the same defect but had already been revoked before the issue was identified. NAVER revoked the affected certificate on 2026-10-13, published an updated ARL, updated the OCSP responder, and issued a replacement cross-certificate with the corrected AIA encoding. The bug remains assigned, and the thread indicates a full incident report was to follow.
- An RSA cross-certificate for NAVER Cloud Trust Services RSA Root G1 was issued with the same AIA encoding defect.
- A replacement RSA cross-certificate was issued for NAVER Cloud Trust Services RSA Root G1.
- NAVER discovered the incorrect AIA accessMethod encoding during an internal review.
- NAVER revoked the affected cross-certificate and issued a replacement with the corrected AIA extension.
- Navercorp representative — Reported a self-discovered incident and said the affected cross-certificate would be revoked within the required timeframe.
- Navercorp representative — Noted that the first comment was unrelated and said the full incident report would follow.
- Navercorp representative — Filed the full incident report, confirming revocation, replacement issuance, updated ARL publication, and OCSP responder update.