2007219 - DigiCert: Some certificates issued with CRLDPs that don’t exactly match CCADB disclosures

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[DigiCert]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36 Edg/143.0.0.0

Steps to reproduce:

Preliminary Incident Report

Summary

• Incident description: DigiCert has received a report that a small number of issued certificates contain CRLDP URLs that do not exactly match the URLs disclosed in CCADB.0 We are continuing to investigate and will provide a full report on or before January 1, 2026.

• Relevant policies: CCADB Policy v2.0, Section 6.2

• Source of incident disclosure: Third Party Reported

Comment 1

[DigiCert]

Full Incident Report

Summary

• CA Owner CCADB unique ID: DigiCert
• Incident description: DigiCert received an external report that a small number of issued certificates contained CRLDP URLs that do not exactly match the URLs disclosed in CCADB. The reporter identified 4 CRLDP URLs. Internal research subsequently identified 334 affected CRLDP URLs.
• Timeline summary:
  • Non-compliance start date: July 15, 2025 (date of first known deviation from CCADB reported CRLDP in leaf certificates)
  • Non-compliance identified date: December 18, 2025
  • Non-compliance end date: No later than Feb 1, 2026
• Relevant policies: CCADB Policy v2.0, Section 6.2
• Source of incident disclosure: Third Party Reported

Impact

• Total number of certificates: N/A
• Total number of "remaining valid" certificates: N/A
• Affected certificate types: CCADB Disclosures
• Incident heuristic: CRLDP URLs that appear in issued certificates but not disclosed in CCADB
• Was issuance stopped in response to this incident, and why or why not?: Issuance was not stopped; all certificates included valid and operational CRLDPs. The CCADB disclosures for affected CAs will be updated with the amended CRLDP values.
• Analysis: The discrepancy is limited to missing CRL URL registrations in CCADB.
• Additional considerations: N/A

Timeline

August 26, 2024: Changes introduced to CCADB API
April 14, 2025: CRLDP synchronization turned off to avoid issues for CCADB
December 18, 2025, 20:07 PM UTC: Report received via email from third party
December 19, 2025: Preliminary incident report filed
December 27, 2025: Internal research completed, 334 CRLDPs identified (expanded from the initially reported 4 URLs)
December 30, 2025: Full report filed

Related Incidents

Multiple recent incidents identified by a third-party researcher across at least 9 CA operators involve CRLDP URL disclosure mismatches between CCADB and issued certificates.

Bug	Date	Description

| [Bug 2007116] | 2025-12-29 | D-Trust: CRL URL Disclosure |
| [Bug 2007238] | 2025-12-28 | Certigna: CRL URL Disclosure |
| [Bug 2007297] | 2025-12-21 | eMudhra: CRL URL mismatch between CCADB disclosure and issued certificates |
| [Bug 2007105] | 2025-12-19 | Certum: CRL URLs disclosed in CCADB do not exactly match the CRL URLs in certificates |
| [Bug 2007098] | 2025-12-19 | GlobalSign: mismatch of CRL URL in CCADB with issued certificate |
| [Bug 2007072] | 2025-12-19 | TrustAsia: CRL disclosure address using HTTPS instead of HTTP |
| [Bug 2007066] | 2025-12-19 | Disig: missing CRL Distribution Point in CCADB
| [Bug 2007216] | 2025-12-19 | GoDaddy: CRL disclosure mismatch between CCADB and issued certificates |
| [Bug 2002402] |2025-11-25 | GoDaddy: Missing R1 Intermediate Full CRL URLs in CCADB |

Root Cause Analysis

Contributing Factor 1: CRLDP URL registration mismatch

• Description: CRL Distribution Point (CRLDP) URLs recorded in CCADB did not match the URLs published in issued end-entity certificates. The CCADB requirement is:

For each unexpired and unrevoked CA certificate record disclosed to the CCADB and within 7 days of the corresponding CA issuing its first certificate, CA Owners MUST disclose either:

• the URL of a full and complete Certificate Revocation List (CRL); or
• a JSON Array of Partitioned CRL URLs.

The information provided to CCADB was correct when the CA was disclosed to CCADB. The subsequent issue included alternate CRLDP URLs used in some leaf certificate profiles and additional partitions added to some CRLs.

Why #1: Why was a manual CRL reporting process being used? DigiCert has automated workflows in place to publish information about DigiCert CAs to CCADB using the CCADB API. This integration, which has been in use for several years, has been reliable in managing the provision of accurate and timely information to CCADB. On August 26, 2024, the CCADB API introduced changes to several required fields, which caused the automated CRL synchronization process to fail. To avoid issues for CCADB, automated CRL synchronization was disabled on April 14, 2025, forcing reliance on manual updates as a workaround. The manual procedure was intended as a short-term measure and was not designed to track or update changes in CRL URLs.

Why #2: Why was the automated CRL synchronization process disabled? Following the changes to the CCADB API, the integration was generating repeated failed requests that created issues for the CCADB API. To prevent impact to CCADB infrastructure, the automated synchronization logic was disabled and a ticket was created for engineering implementation.

Why #3: Why was the automated system generating failed requests to the CCADB API? The CCADB API introduced changes to several required fields. These API changes broke compatibility with DigiCert's existing automated CRL synchronization controls, causing submission attempts to CCADB to fail.

Why #4: Why wasn't the API compatibility issue prioritized and resolved? After the ticket was created, since certificates included CABF-compliant and functioning CRLDP, DigiCert did not appropriately consider the impact on adherence to the CCADB Policy. This left the root cause unresolved, with continued reliance on the manual workaround.

Why #5: Why did the CRLDP URLs in CCADB not match the URLs in issued certificates? Intended for short duration, the manual CRL update process did not account for CRLDP URL changes following the original CCADB filings ; therefore, subsequent use of alternate CRLDP URLs or changes in partition URLs were not tracked or updated.

Root cause: Lack of prioritization and resolution of the engineering ticket to restore automated CRL synchronization after CCADB API changes broke integration compatibility.

• Timeline: Our analysis indicates that CRLDP URL discrepancies exist in CCADB entries for some CAs between July 15, 2025 and December 18, 2025 when the issue was reported.
• Detection: Reported by third party, internal review confirmed additional affected CRLs.
• Interaction with other factors: N/A
• Root Cause Analysis methodology used: Five Whys and comparison of CRLDP URLs in issued certificates against CCADB registry.

Lessons Learned

• What went well: Rapid acknowledgment and preliminary investigation of reported discrepancy. CRLs functioned as intended.
• What didn’t go well: In normal operations, our extensive automation with the CCADB API ensures prompt updates and accuracy. An update to accommodate changes to the CCADB API was not appropriately prioritized for correction.
• Where we got lucky: CRLs remained functional so no certificate validation failures occurred, and no Subscriber harm resulted from disclosure gap.
• Additional: The incident underlines the value of continuous CCADB synchronization, and the importance of integration testing before API changes.

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Complete audit of all affected CRLs	Prevent	CRLDP URL registration mismatch	All CRLDPs compared to CCADB disclosures	2026-01-01	Complete
Update API automation	Prevent	CRLDP URL registration mismatch	Restoration of automated CRLDP updates	2026-02-01	Planned
Prioritization of future API automation updates	Prevent	CRLDP URL registration mismatch	CCADB API issues to be treated as critical compliance	2025-12-31	Complete

Appendix

Relevant policy: CCADB Policy v2.0, Section 6.2 [https://www.ccadb.org/policy#62-certificate-revocation-list-disclosures]

Comment 2

[DigiCert]

Attachment: missing_crl_full_list_bugzilla.csv

Comment 3

[DigiCert]

We are on track to update the API automation as previously noted, which will restore the synchronization of CRLDP updates by 2026-02-01. We request the “Next update” Whiteboard field for this Bug to be set for 2026-02-02.

Comment 4

[DigiCert]

We’ve completed all action items and plan to post a Closure Summary by early next week.

Comment 5

[DigiCert]

Report Closure Summary

• Incident description:

DigiCert identified an issue where a subset of issued certificates contained CRL Distribution Point (CRLDP) URLs that did not precisely match those disclosed in the Common CA Database (CCADB). Initially, four mismatched CRLDP URLs were reported, but further internal investigation revealed 334 affected URLs across various Certificate Authorities (CAs). The non-compliance began on July 15, 2025, was identified on December 18, 2025, and was resolved on January 30, 2026, with no impact on certificate validation or end-users as the CRLs remained operational.

• Incident Root Cause(s):

The root cause stemmed from changes to the CCADB API on August 26, 2024, which disrupted DigiCert's automated CRL synchronization process, leading to its disablement on April 14, 2025. Reliance on a manual update process failed to adequately track and reflect changes in CRLDP URLs post-initial filing. This was compounded by a lack of prioritization in resolving the engineering ticket to restore automated synchronization, resulting in registration mismatches.

• Remediation description:

DigiCert conducted a comprehensive audit of all affected CRLs, completed by January 1, 2026, and updated CCADB disclosures with the amended CRLDP values. Automated CRLDP updates via the CCADB API were restored by February 1, 2026, and future API automation updates were prioritized as critical compliance issues by December 31, 2025. All identified mismatches were corrected, ensuring full alignment between issued certificates and CCADB records.

• Commitment summary:
  • Ongoing monitoring and integration testing for CCADB API changes to prevent future compatibility issues.
  • Continuous improvement in manual processes as a backup to automation, including regular reviews of CRLDP registrations.
  • Enhanced prioritization protocols for compliance-related engineering tickets to ensure timely resolution.

All Action Items disclosed in this report have been completed as described, and we request its closure.

Comment 6

[incident-reporting]

This is a final call for comments or questions on this Incident Report.

Otherwise, it will be closed on approximately 2026-02-16.