SHECA: subordinate certificates have not published the complete CRL address in CCADB
Categories
(CA Program :: CA Certificate Compliance, task)
Tracking
(Not tracked)
People
(Reporter: wangjiatai, Assigned: wangjiatai)
Details
(Whiteboard: [ca-compliance] [disclosure-failure])
Preliminary Incident Report
Summary
-
Incident Description Some of SHECA's Subordinate certificates do not publish the complete CRL address.
-
Relevant policies: CCADB Policy 6.2
For each unexpired and unrevoked CA certificate record disclosed to the CCADB and within 7 days of the corresponding CA issuing its first certificate, CA Owners MUST disclose either:
- the URL of a full and complete Certificate Revocation List (CRL); or
- a JSON Array of Partitioned CRL URLs.
-
Source of incident disclosure: Third Party Reported.
Due to a configuration error during the initial issuance, some subscriber certificates incorrectly used the Partitioned CRL address in their CRLs.Upon receiving an internal monitoring alert, SHECA immediately corrected the CRLs to full CRLs and configured forwarding rules to forward the incorrectly used Partitioned CRL addresses to the corresponding full CRLs of the Subordinate certificates. However, the Partitioned CRL addresses issued in the subscriber certificates were not disclosed in ccadb.
The subordinate certificates involved are as follows:
| Subordinate certificates |
|---|
| CT2 OV TLS RSA CA G2 |
| KeepTrust DV TLS RSA CA G1 |
| SHECA DV TLS RSA CA 1A |
| SHECA OV TLS RSA CA 1A |
|
||
Updated•8 months ago
|
Update
A full incident report is expected to be released by December 31, 2025.
Full Incident Report
All times are UTC+8
Summary
-
CA Owner CCADB unique ID:
A000261 -
Incident description:
SHECA received an email from the third party stating that the CRL URLs of some certificates have not been disclosed to CCADB. SHECA immediately launched an investigation and identified the cause as follows:
-
There was a CRL configuration error during the initial issuance of certain sub-CA certificates, resulting in some subscriber certificates using the Partitioned CRLs in their CRLs field. After receiving the internal monitoring alert, SHECA corrected the Partitioned CRLs to Full CRLs and configured forwarding rules to forward the incorrectly used Partitioned CRLs to the corresponding Full CRLs.
-
However, SHECA only disclosed the final Full CRLs, and the Partitioned CRLs configured due to human operation errors have not yet been disclosed to CCADB, which violates the CCADB Policy 6.2.
-
Timeline summary:
- Non-compliance start date:
2024-03-27 00:00:00 - Non-compliance identified date:
2025-12-19 04:01:24 - Non-compliance end date:
2025-12-21 10:30:00
- Non-compliance start date:
-
Relevant policies: CCADB Policy 6.2
For each unexpired and unrevoked CA certificate record disclosed to the CCADB and within 7 days of the corresponding CA issuing its first certificate, CA Owners MUST disclose either:
- the URL of a full and complete Certificate Revocation List (CRL); or
- a JSON Array of Partitioned CRL URLs.
-
Source of incident disclosure:
Third Party Reported
Impact
-
Total number of certificates:
N/A, as there were no certificates misissued -
Total number of "remaining valid" certificates:
N/A, as there were no certificates misissued -
Affected certificate types:
N/A, as there were no certificates misissued -
Incident heuristic:
The table below shows the subCAs involved in this case, as well as the unpublished Certificate Revocation Lists (CRLs) associated with the subCAs and the subscriber certificates involved.
-
Was issuance stopped in response to this incident, and why or why not?:
As there were no certificates misissued, issuance was not stopped. -
Analysis:
N/A -
Additional considerations:
N/A
==Timeline==
==All times are UTC+8==
2024-03-27, 00:00 – Issued the sub-CA certificates SHECA OV TLS RSA CA 1A and SHECA DV TLS RSA CA 1A.
2025-08-09, 00:00 – Detected that the subscriber certificate templates corresponding to SHECA OV TLS RSA CA 1A and SHECA DV TLS RSA CA 1A were configured with Partitioned CRL. Adjusted the subscriber certificate templates to Full CRL, and then redirected the incorrectly issued Partitioned CRL addresses to the corresponding Full CRL addresses.
2024-04-14, 00:00 – Issued the certificate KeepTrust DV TLS RSA CA G1.
2024-04-21, 00:00 – Detected that the subscriber certificate templates for certificates issued by KeepTrust DV TLS RSA CA G1 were configured with Partitioned CRL. Adjusted the subscriber certificate templates to Full CRL, and then redirected the incorrectly issued Partitioned CRL addresses to the corresponding Full CRL addresses.
2025-05-06, 00:00 – Issued the certificate CT2 OV TLS RSA CA G2.
2025-07-18, 00:00 – Detected that the subscriber certificate templates for certificates issued by CT2 OV TLS RSA CA G2 were configured with Partitioned CRL. Adjusted the subscriber certificate templates to Full CRL, and then redirected the incorrectly issued Partitioned CRL addresses to the corresponding Full CRL addresses.
2025-12-19 04:01 – Received an alert from a third party stating that the Partitioned CRL issued due to the aforementioned issues had not been disclosed in the CCADB.
2025-12-19, 09:00 – SHECA immediately launched an investigation into the relevant issues.
2025-12-19, 11:06 – SHECA released an initial incident report.
2025-12-19, 22:20 – Disclosed the initially identified omitted Partitioned CRL in the CCADB.
2025-12-20, 09:30 – Conducted a full-scale scan of the certificates to check for any undisclosed CRLs.
2025-12-20,21:18 – Disclosed all omitted CRLs in the CCADB.
2025-12-21, 10:30 – Conducted a second full-scale scan of the certificates to check for any undisclosed CRLs; no omissions were found.
2025-12-31, 23:00 – Released a full incident report.
Related Incidents
| Bug | Date | Description |
|---|---|---|
| Bug 1964167 | 2025-05-02 | VikingCloud:Missing CRL in CCADB |
| Bug 1990801 | 2025-09-25 | improper disclosure of CRL |
| Bug 2001327 | 2025-11-20 | Missing CDP Disclosure in CCADB |
| Bug 2002402 | 2025-11-25 | Missing R1 Intermediate Full CRL URLs in CCADB |
| Bug 2007116 | 2025-12-19 | CRL URL Disclosure |
| Bug 2007098 | 2025-12-19 | CRL URL Disclosure |
Root Cause Analysis
Contributing Factor #1: Complex Operation for Configuring CRLs in the CA System
-
Description:
The SHECA CA system issues partition CRLs by default; however, SHECA's TLS certificates use full CRLs by default. Previously (before August 5, 2025), when operators configured Full CRLs in the CA system, they needed to manually add special symbols (@) at the start and end of the specified URL to mark the issuance of Full CRLs. This operation relied on manual editing, which was highly prone to input omissions or format errors, leading to CRLs configuration error
To address the above issue, SHECA completed the system function optimization on August 5, 2025. After optimization, operators no longer need to manually edit the URL; they can select to issue Full CRLs or Partitioned CRLs simply by checking the corresponding options, which greatly reduces the risk of human operation errors.
-
Timeline:
This issue existed consistently before the system function optimization on August 5, 2025.
-
Detection:
Through feedback from the operation department, the product team collected this requirement and implemented the fix.
-
Interaction with other factors:
Factor 1 and Factor 2 jointly led to the occurrence of the violation. Factor 1 directly caused the error; however, if the automated tool mentioned in Factor 2 had been in place, the final violation could have been avoided.
-
Root Cause Analysis methodology used:
5-Whys
Contributing Factor #2: Failure to Enable Automated Tools for Synchronizing CRLs to CCADB
-
Description:
Due to human error, these incorrectly issued CRLs failed to synchronize with CCADB. SHECA is improving its reporting mechanism so that each time a new CRL is issued, SHECA's system immediately synchronizes it with CCADB via the CCADB API.
-
Timeline:
This issue existed consistently.
-
Detection:
During the investigation, SHECA discovered that there was no automated tool to synchronize CRL to CCADB, which greatly increased the probability of such problems occurring.
-
Interaction with other factors:
Factor 1 and Factor 2 jointly led to the occurrence of the violation. Factor 1 directly caused the error; however, if the automated tool mentioned in Factor 2 had been in place, the final violation could have been avoided.
-
Root Cause Analysis methodology used:
5-Whys
Lessons Learned
-
What went well:
After receiving the third-party email, SHECA responded quickly, and found the causes within 24 hours.
-
What didn’t go well:
N/A -
Where we got lucky:
N/A -
Additional:
N/A
Action Items
| Action Item | Kind | Corresponding Root Cause(s) | Evaluation Criteria | Due Date | Status |
|---|---|---|---|---|---|
| Optimize the CRL configuration methods in the CA system to avoid human errors | prevent | Factor #1 | The function is luanched. | 2025-08-05 | Completed |
| Integrate the release of new CRLs with the automated API of the CCADB to ensure that each CRL is promptly updated to the CCADB. | prevent | Factor #2 | The API is integrated. | 2026-01-31 | Ongoing |
Appendix
N/A
Action Items Update
| Action Item | Kind | Corresponding Root Cause(s) | Evaluation Criteria | Due Date | Status |
|---|---|---|---|---|---|
| Optimize the CRL configuration methods in the CA system to avoid human errors | prevent | Factor #1 | The function is luanched. | 2025-08-05 | Completed |
| Integrate the release of new CRLs with the automated API of the CCADB to ensure that each CRL is promptly updated to the CCADB. | prevent | Factor #2 | The API is integrated. | 2026-01-31 | Ongoing |
Action Items Update
| Action Item | Kind | Corresponding Root Cause(s) | Evaluation Criteria | Due Date | Status |
|---|---|---|---|---|---|
| Optimize the CRL configuration methods in the CA system to avoid human errors | prevent | Factor #1 | The function is luanched. | 2025-08-05 | Completed |
| Integrate the release of new CRLs with the automated API of the CCADB to ensure that each CRL is promptly updated to the CCADB. | prevent | Factor #2 | The API is integrated. | 2026-01-31 | Ongoing |
Action Items Update
| Action Item | Kind | Corresponding Root Cause(s) | Evaluation Criteria | Due Date | Status |
|---|---|---|---|---|---|
| Optimize the CRL configuration methods in the CA system to avoid human errors | prevent | Factor #1 | The function is luanched. | 2025-08-05 | Completed |
| Integrate the release of new CRLs with the automated API of the CCADB to ensure that each CRL is promptly updated to the CCADB. | prevent | Factor #2 | The API is integrated. | 2026-01-31 | Ongoing |
Action Items Update
| Action Item | Kind | Corresponding Root Cause(s) | Evaluation Criteria | Due Date | Status |
|---|---|---|---|---|---|
| Optimize the CRL configuration methods in the CA system to avoid human errors | prevent | Factor #1 | The function is luanched. | 2025-08-05 | Completed |
| Integrate the release of new CRLs with the automated API of the CCADB to ensure that each CRL is promptly updated to the CCADB. | prevent | Factor #2 | The API is integrated. | 2026-01-31 | Completed |
Report Closure Summary
- Incident description: Due to a configuration error during the initial issuance, some subscriber certificates incorrectly used the Partitioned CRL address in their CRLs. Upon receiving an internal monitoring alert, SHECA immediately corrected the CRLs to full CRLs and configured forwarding rules to forward the incorrectly used Partitioned CRL addresses to the corresponding full CRLs of the Subordinate certificates. However, the Partitioned CRL addresses issued in the subscriber certificates were not disclosed in CCADB.
- Incident Root Cause(s): Complex operation for configuring CRLs in the CA System and failure to enable automated tools for synchronizing CRLs to CCADB jointly led to the occurrence of the violation.
- Remediation description: SHECA optimized the CRL configuration methods in the CA system to avoid human errors, and integrated the release of new CRLs with the automated API of the CCADB to ensure that each CRL is promptly updated to the CCADB.
- Commitment summary: SHECA commits to continuously advancing the automation of its CA system, strictly complying with CCADB regulations, and keeping transparency to the community.
All Action Items disclosed in this report have been completed as described, and we request its closure.
|
|
||
Comment 8•6 months ago
|
||
This is a final call for comments or questions on this Incident Report.
Otherwise, it will be closed on approximately 2026-02-16.
|
|
||
Updated•6 months ago
|
Description
•