Asseco DS / Certum: Incomplete CRL URL disclosures in CCADB for intermediate CA records

This case concerns a third-party Certificate Problem Report alleging that several intermediate CA records in CCADB do not disclose the full set of CRL URLs that appear in the corresponding root CA records with the same subject and public key. The report names six affected CA records, including Certum and TrustAsia roots/intermediates. Certum says it received the report on 2026-10-12 and opened an internal investigation to verify the discrepancies, determine scope and root cause, and identify corrective actions. The bug states that the relevant requirement is CCADB Policy section 6.2 on CRL disclosures. Certum also says a full incident report will be provided within the required timeframe. The case remains open and assigned.

1. 2026-10-12 A third-party CPR reported potentially incomplete CRL URL disclosures in CCADB records for several intermediate CA certificates.
2. 2026-10-15 Certum opened this bug and began an internal investigation into the reported CCADB disclosure discrepancies.

1. 2026-10-15 Assecods representative — Certum filed a preliminary incident report describing the third-party CPR, the affected CA records, the CCADB Policy section 6.2 requirement, and the ongoing investigation.