Disig CRL broken / mis-listed; CA list CRL links need auditing

The bug reports that Disig’s CRL URL (http://www.disig.eu/ca/crl/ca_disig.crl) could not be imported into Firefox, producing an “Error Importing CRL to local Database” error. The reporter found that CRLs listed on Disig’s CRL page (http://www.disig.eu/index.php?id=crl&L=1) produced the same import error and noted that the URIs differed from the one linked from Mozilla’s Included Certificates list. Mozilla staff indicated they would review other CRL links on the Included page, and one staff member confirmed that the SwissSign links worked for them. Disig’s representative stated they checked their CRL distribution points and said the issue was resolved for Mozilla by removing a critical CIDP extension from their CRLs because NSS does not support that critical extension. The reporter later confirmed that the Disig CRL listed for Disig now correctly imports into their Firefox browser and closed the bug, while noting that the E-TUGRA CRL problem still existed and was tracked in a separate bug. The bug was resolved as FIXED.

1. 2011-10-12 Reporter discovers Disig’s CRL cannot be imported in Firefox and reports the issue in Bugzilla.
2. 2011-10-21 Disig updates/removes the problematic critical CIDP extension so the Disig CRL imports correctly in Mozilla browsers.
3. 2011-10-21 Reporter confirms Disig CRL now imports correctly and closes the bug.

1. 2011-10-12 Ironhavoc representative — Reports that importing Disig’s CRL from http://www.disig.eu/ca/crl/ca_disig.crl fails in Firefox and that CRLs from Disig’s CRL list also fail, suggesting Mozilla’s Included Certificates CRL links may be wrong or incomplete.
2. 2011-10-12 Ironhavoc representative — Adds that other CRL/OCSP endpoints (e.g., E-TUGRA and SwissSign) appear missing or timing out, and that some CRLs may be in bad format or unusable.
3. 2011-10-21 Mozilla representative — Asks Mozilla staff to review the CRL issues and points to the Disig and E-TUGRA sections of the Included Certificates list.
4. 2011-10-21 Disig, a.s. — Explains the import error is caused by a critical CIDP extension (RFC 5280 5.2.5) that NSS does not support, and says Disig removed the extension so importing works for Mozilla.
5. 2011-10-21 Mozilla representative — Confirms all CRLs in the Included Certificates List were tested, confirms the Disig CRL now imports correctly, and closes this bug while tracking the E-TUGRA CRL issue in bug #696466.