Microsoft PKI Services: Improper Disclosure of CRL
Categories
(CA Program :: CA Certificate Compliance, task)
Tracking
(Not tracked)
People
(Reporter: CentralPKI, Assigned: CentralPKI)
Details
(Whiteboard: [ca-compliance] [disclosure failure])
Preliminary Incident Report
Summary
-
Incident description: In August 2025, Microsoft PKI Services created twelve (12) new Certification Authorities (CAs) and added them to the CCADB.
In September, we opened Bugzilla 1990801 – Microsoft: improper disclosure of CRL after identifying that the JSON Array of Partitioned CRL URLs for one of the newly created CAs had been incorrectly formatted, resulting in a violation of Section 6.2 of the CCADB Policy. To resolve that bug, we removed the JSON array and instead listed the full (non‑partitioned) CRL URL for each of the 12 affected CAs.
On 2025‑12‑18 at ~12:02 PM PST, Microsoft PKI Services received a Certificate Problem Reporting email indicating that we may still be in violation of Section 6.2. The reporter examined six recently issued certificates (from two of the twelve CAs) and observed that the CRL Distribution Point (CDP) URLs contained in the certificates were partitioned CRL URLs, which were not listed in CCADB.
Following investigation, we determined that the correct approach to comply with Section 6.2 is to disclose the JSON Array of Partitioned CRL URLs in CCADB for all twelve CAs, rather than relying on a single full CRL URL.
On 2025‑12‑19 at ~2:03 PM PST, Microsoft PKI Services updated all twelve CAs in CCADB to include the full JSON Array of Partitioned CRL URLs.
-
Relevant policies:
Section 6.2 of CCADB Policy: Certificate Revocation List Disclosures -
Source of incident disclosure:
Microsoft PKI Services was notified via Certificate Problem Reporting email on 2025-12-18 at ~12:02 PM PST.
|
||
Updated•3 months ago
|
|
Assignee | |
Comment 1•3 months ago
|
||
Full Incident Report
Summary
- CA Owner CCADB unique ID: A002577
- Incident description:
In August 2025, Microsoft PKI Services created twelve (12) new Certification Authorities (CAs) and added them to the CCADB (See Appendix for specifics).
In September, we opened Bugzilla 1990801 – Microsoft: improper disclosure of CRL after identifying that the JSON Array of Partitioned CRL URLs for one of the newly created CAs had been incorrectly formatted, resulting in a violation of Section 6.2 of the CCADB Policy. To resolve that bug, we removed the JSON array and instead listed the full CRL URL for each of the 12 affected CAs.
On 2025‑12‑18 at ~12:02 PM PST, Microsoft PKI Services received a Certificate Problem Reporting email indicating that we may still be in violation of Section 6.2. The reporter examined six recently issued certificates (from two of the twelve CAs) and observed that the CRL Distribution Point (CDP) URLs contained in the certificates were partitioned CRL URLs, which were not listed in CCADB (Please note: all CRL URLs listed in certificates correctly resolved to the applicable CRL, the issue is that not all listed CRLs were published in CCADB).
Following investigation, we determined that the correct approach to comply with Section 6.2 is to disclose the JSON Array of Partitioned CRL URLs in CCADB for all twelve CAs, rather than relying on a single full CRL URL.
On 2025‑12‑19 at ~2:03 PM PST, Microsoft PKI Services updated all twelve CAs in CCADB to include the full JSON Array of Partitioned CRL URLs.
-
Timeline summary:
- Non-compliance start date: 2025-09-23
- Non-compliance identified date: 2025-12-18 ~12:02 PM PST
- Non-compliance end date: 2025‑12‑19 ~2:03 PM PST
-
Relevant policies: Section 6.2 of CCADB Policy: Certificate Revocation List Disclosures (https://www.ccadb.org/policy#62-certificate-revocation-list-disclosures)
-
Source of incident disclosure: Microsoft PKI Services was notified via Certificate Problem Reporting email on 2025-12-18 at ~12:02 PM PST.
Impact
- Total number of certificates: 0
- Total number of "remaining valid" certificates: N/A
- Affected certificate types: N/A
- Incident heuristic: N/A
- Was issuance stopped in response to this incident, and why or why not? N/A
- Analysis: N/A
- Additional considerations: N/A
Timeline
-
2025-09-23 – MS PKI Services Added 12 new CA certs to CCADB and updated Metadata (including CRL information)
-
2025-09-25 – MS PKI Services was notified via email Problem Report that there was an issue with 1 of the 12 Partitioned JSON Array’s that we updated in CCADB
-
2025-09-25 – MS PKI Services investigated the Problem Report and resolved the JSON Array issue for the CA in question.
-
2025-12-18 – MS PKI Services received a problem report specific to 2 of the 12 CAs mentioned above. The CRLs listed in the certificates issued by these CAs were not listed in CCADB.
-
2025-12-19 - MS PKI Services mitigated the issue by posting the JSON Array of partitioned CRLs in CCADB.
Related Incidents
| Bug | Date | Description |
|---|---|---|
| 2007089 | 2025-12-19 | SHECA: subordinate certificates have not published the complete CRL address in CCADB |
| 2007105 | 2025-12-19 | Asseco DS / Certum: CRL URLs disclosed in CCADB do not exactly match the CRL URLs in certificates |
| 2007238 | 2025-12-20 | Certigna: CRL URL Disclosure |
| 2007098 | 2025-12-19 | GlobalSign: misalignment of CRL URL in CCADB with issued certificates |
| 2007116 | 2025-12-19 | D-Trust: CRL URL Disclosure |
| 2007297 | 2025-12-21 | eMudhra emSign PKI Services: CRL URL Mismatch Between CCADB Disclosure and Issued Certificates |
| 2007072 | 2025-12-19 | TrustAsia: CRL disclosure address incorrectly using HTTPS scheme in CCADB |
| 2007066 | 2025-12-18 | Disig: Missing CA Disig R2I2 Certification Service Full CRL URLs in CCADB |
| 2007216 | 2025-12-19 | GoDaddy: CRL Disclosure in CCADB Mismatch with Issued Certificates |
Root Cause Analysis
-
Contributing Factor #1 We incorrectly interpreted the best way to comply with Section 6.2 of the CCADB Policy in September 2025 when we updated these CAs in CCADB.
- Description: In a previous incident specific to Section 6.2, we focused on the errors inherent in MANUALLY updating CCADB and determined the best course of action was to keep it simple and post Full CRLs (as the policy has an “OR” selection). What we failed to consider is that the Section as a WHOLE focuses on what will be published in the issued certificates. After this Problem Report that fact stood out to us and we have now updated our process for CAs with partitioned CRLs to post the JSON Array.
-
Timeline:
- 2025-09-23 – As described in 1990801 - Microsoft: improper disclosure of CRL we updated CRLs in CCADB for the first 12 CAs that Microsoft PKI Services has created with partitioned CRLs.. This was the start of non-compliance.
- 2025-09-25 – We resolved the improper JSON Array issue by reverting to FULL CRLs in CCADB. We now understand that was problematic, while it helped to mitigate the errors in posting erroneous JSON Arrays, it did not address all the requirements of Section 6.2.
- 2025-12-19 – We resolved the non-compliance by updating our process for posting JSON Arrays manually to CCADB and updating the 12 CAs that had this issue in CCADB.
-
Detection: Incident investigation.
-
Interaction with other factors: Primary issue is in considering Section 6.2 as a whole and compliance with all parts of the Section.
-
Root Cause Analysis methodology used: 5 Whys
Lessons Learned
- What went well: All CRLs are current and up to date (before and after the incident).
- What didn’t go well: Improper disclosure of all of the CRLs that are published in our certificates in CCADB.
- Where we got lucky: We were notified of this compliance issue by a third party.
- Additional: N/A
Action Items
| Action Item | Kind | Corresponding Root Cause(s) | Evaluation Criteria | Due Date | Status |
|---|---|---|---|---|---|
| Update CRL JSON Array in CCADB for the 12 CAs in question | Mitigate | Root Cause # 1 | 12 CAs are updated in CCADB with JSON Array of CRL URLs that are published in issued certificates. | 2025-12-19 | Complete |
| Update process to post CRL JSON Arrays in CCADB to avoid incidents like we had in Sept 2025 (improper JSON issue) | Mitigate | Root Cause #1 | Internal process for team to follow is updated and documented. | 2025-12-19 | Complete |
| Investigate to ensure all CAs disclosed have the correct CDPs listed | Mitigate | Root Cause #1 | Complete internal review to ensure that all posted CRLs in CCADB are properly disclosed, to date we have only identified 12 CAs. | 2026-1-09 | In Process |
| Add detection capabilities to ensure CRLs posted in CCADB are what we are publishing in Certificates | Detect | Root Cause #1 | Tools and/or processes in place to ensure we quickly detect and mitigate any future CDPs that are not disclosed in CCADB | 2026-2-20 | In Process |
Appendix
Twelve CAs with Improper Disclosure of CRLs in CCADB are listed here:
|
|
Assignee | |
Comment 2•2 months ago
|
||
FIR Update
During our investigation into the Action Item, "all CAs disclosed having the correct CDPs", we discovered on 2025-01-06 that we have additional syntax issues with the CRL URLs posted in CCADB. These were discovered when we checked the CRL Watch tool.
There are 3 issues currently identified in the tool with respect to 20 Issuer IDs. The 3 issues are “Issuing Distribution Point (IDP) does not contain expected URL”, “unsupported protocol scheme” and “does not match CA subject”. Appendix B below lists the specific issues identified.
Microsoft PKI Services is working through remediation of these issues now, and we have updated Action Items below.
Action Items
| Action Item | Kind | Corresponding Root Cause(s) | Evaluation Criteria | Due Date | Status |
|---|---|---|---|---|---|
| Update CRL JSON Array in CCADB for the 12 CAs in question | Mitigate | Root Cause # 1 | 12 CAs are updated in CCADB with JSON Array of CRL URLs that are published in issued certificates. | 2025-12-19 | Complete |
| Update process to post CRL JSON Arrays in CCADB to avoid incidents like we had in Sept 2025 (improper JSON issue) | Mitigate | Root Cause #1 | Internal process for team to follow is updated and documented. This is specific to the issue related to improper JSON Array formatting. | 2025-12-19 | Complete |
| Investigate to ensure all CAs disclosed have the correct CDPs listed | Mitigate | Root Cause #1 | Complete internal review to ensure that all posted CRLs in CCADB are properly disclosed, to date we have only identified 12 CAs. | 2026-1-30 | In Process |
| Add detection capabilities to ensure CRLs posted in CCADB are what we are publishing in Certificates | Detect | Root Cause #1 | Tools and/or processes in place to ensure we quickly detect and mitigate any future CDPs that are not disclosed in CCADB | 2026-2-20 | In Process |
| Check that ALL CDPs disclosed in CCADB for all CAs, are byte for byte identical to the CRL URLs that are listed in Issued Certificates | Detect | Root Cause #1 | Complete internal review to ensure that all posted CRLs (from all MPS CAs) in CCADB are byte for byte identical to the CRL URLs that are listed in Issued Certificates. | 2026-1-16 | In Process |
| Update process to post CRL URLs in CCADB to ensure they are byte for byte identical to what is posted in Issued Certificates. | Mitigate | Root Cause #1 | Internal process for team to follow is updated and documented. This is related to the issue where the URLs are not byte for byte identical to each other. | 2026-1-30 | In Process |
| Update all CRL URLs in CCADB that have identified syntax issues. | Mitigate | Root Cause #1 | Repair all identified syntax issues in CCADB | 2026-1-30 | In Process |
Appendix B – CA Issues in CRL Watch
(In reply to Microsoft PKI Services from comment #2)
FIR Update
During our investigation into the Action Item, "all CAs disclosed having the correct CDPs", we discovered on 2025-01-06 that we have additional syntax issues with the CRL URLs posted in CCADB. These were discovered when we checked the CRL Watch tool.
There are 3 issues currently identified in the tool with respect to 20 Issuer IDs. The 3 issues are “Issuing Distribution Point (IDP) does not contain expected URL”, “unsupported protocol scheme” and “does not match CA subject”. Appendix B below lists the specific issues identified.
Those are separate incidents and should be filed within 72 hours of your discovery. During the incident report it would be worth noting why this was overlooked despite multiple overlapping incidents by yourselves for this time period.
|
|
Assignee | |
Comment 4•2 months ago
|
||
Response to Comment 3 - Wayne
FIR Update
During our investigation into the Action Item, "all CAs disclosed having the correct CDPs", we discovered on 2025-01-06 that we have additional syntax issues with the CRL URLs posted in CCADB. These were discovered when we checked the CRL Watch tool.
There are 3 issues currently identified in the tool with respect to 20 Issuer IDs. The 3 issues are “Issuing Distribution Point (IDP) does not contain expected URL”, “unsupported protocol scheme” and “does not match CA subject”. Appendix B below lists the specific issues identified.
Those are separate incidents and should be filed within 72 hours of your discovery. During the incident report it would be worth noting why this was overlooked despite multiple overlapping incidents by yourselves for this time period.
We agree with your suggestion. In response we have opened the following Bugzilla’s to track each issue individually:
• 2009539 - Microsoft PKI Services: Improper Disclosure of CRLs – IDP – Existing CAs
• 2009542 - Microsoft PKI Services: Improper Disclosure of CRLs – IDP – New CAs
• 2009543 - Microsoft PKI Services: Improper Disclosure of CRLs – Does Not Match CA Subject
• 2009543 - Microsoft PKI Services: Improper Disclosure of CRLs – Does Not Match CA Subject
We will follow CCADB IRG for these Bugzillas.
|
|
Assignee | |
Comment 5•2 months ago
|
||
Weekly Status Update
In our previous FIR update, we noted additional syntax issues related to our CRLs. Per the suggestion of Wayne in Comment 3 we have opened individual Bugzilla entries for each issue identified in CRL Watch to ensure targeted remediation. These new bugs will track fixes for the three syntax-related problems—“Issuing Distribution Point (IDP) does not contain expected URL”, “unsupported protocol scheme” and “does not match CA subject” While these bugs address specific findings, we are reverting to the original repair items for this bug to maintain alignment with our broader remediation plan and process improvements for this specific issue.
| Action Item | Kind | Corresponding Root Cause(s) | Evaluation Criteria | Due Date | Status |
|---|---|---|---|---|---|
| Update CRL JSON Array in CCADB for the 12 CAs in question | Mitigate | Root Cause #1 | 12 CAs are updated in CCADB with JSON Array of CRL URLs that are published in issued certificates. | 2025-12-19 | Complete |
| Update process to post CRL JSON Arrays in CCADB to avoid incidents like we had in Sept 2025 (improper JSON issue) | Mitigate | Root Cause #1 | Internal process for team to follow is updated and documented. This is specific to the issue related to improper JSON Array formatting. | 2025-12-19 | Complete |
| Investigate to ensure all CAs disclosed have the correct CDPs listed | Mitigate | Root Cause #1 | Complete internal review to ensure that all posted CRLs in CCADB are properly disclosed. To date we have only identified 12 CAs. | 2026-01-30 | In Process |
| Add detection capabilities to ensure CRLs posted in CCADB are what we are publishing in Certificates | Detect | Root Cause #1 | Tools and/or processes in place to ensure we quickly detect and mitigate any future CDPs that are not disclosed in CCADB | 2026-02-20 | In Process |
|
|
Assignee | |
Comment 6•2 months ago
|
||
Correction to Comment 4
We agree with your suggestion. In response we have opened the following Bugzilla’s to track each issue individually:
• 2009539 - Microsoft PKI Services: Improper Disclosure of CRLs – IDP – Existing CAs
• 2009542 - Microsoft PKI Services: Improper Disclosure of CRLs – IDP – New CAs
• 2009543 - Microsoft PKI Services: Improper Disclosure of CRLs – Does Not Match CA Subject
• 2009543 - Microsoft PKI Services: Improper Disclosure of CRLs – Does Not Match CA Subject
We added a duplicate link for Bugzilla 2009543. Please note that the 4th bug is:
2009545 - Microsoft PKI Services: Improper Disclosure of CRLs – Protocol Scheme
|
|
Assignee | |
Comment 7•2 months ago
|
||
Weekly Status Update
We are actively working on all repair items mentioned in the Full incident report. Please note that for the items marked complete they are specific to the issue being discussed in this Bugzilla (JSON Array for partitioned CA). Additional issues related to the disclosure of the CRLs currently exist for these CAs. The remediation for them will be tackled in the appropriate Bugzilla that have been opened.
| Action Item | Kind | Corresponding Root Cause(s) | Evaluation Criteria | Due Date | Status |
|---|---|---|---|---|---|
| Update CRL JSON Array in CCADB for the 12 CAs in question | Mitigate | Root Cause #1 | 12 CAs are updated in CCADB with JSON Array of CRL URLs that are published in issued certificates. | 2025-12-19 | Complete |
| Update process to post CRL JSON Arrays in CCADB to avoid incidents like we had in Sept 2025 (improper JSON issue) | Mitigate | Root Cause #1 | Internal process for team to follow is updated and documented. This is specific to the issue related to improper JSON Array formatting. | 2025-12-19 | Complete |
| Investigate to ensure all CAs disclosed have the correct CDPs listed | Mitigate | Root Cause #1 | Complete internal review to ensure that all posted CRLs in CCADB are properly disclosed. To date we have only identified 12 CAs. | 2026-01-30 | In Process |
| Add detection capabilities to ensure CRLs posted in CCADB are what we are publishing in Certificates | Detect | Root Cause #1 | Tools and/or processes in place to ensure we quickly detect and mitigate any future CDPs that are not disclosed in CCADB. | 2026-02-20 | In Process |
|
|
Assignee | |
Comment 8•2 months ago
|
||
Weekly Status Update
We are actively working on all repair items mentioned in the Full incident report. No new changes at this time.
|
|
Assignee | |
Comment 9•2 months ago
|
||
Weekly Status Update
We are actively working on all repair items mentioned in the Full incident report. The due date for action item #3 has been extended to February 20th to allow additional time to complete internal reviews of CCADB-disclosed information.
| Action Item | Kind | Corresponding Root Cause(s) | Evaluation Criteria | Due Date | Status |
|---|---|---|---|---|---|
| Update CRL JSON Array in CCADB for the 12 CAs in question | Mitigate | Root Cause #1 | 12 CAs are updated in CCADB with JSON Array of CRL URLs that are published in issued certificates. | 2025-12-19 | Complete |
| Update process to post CRL JSON Arrays in CCADB to avoid incidents like we had in Sept 2025 (improper JSON issue) | Mitigate | Root Cause #1 | Internal process for team to follow is updated and documented. This is specific to the issue related to improper JSON Array formatting. | 2025-12-19 | Complete |
| Investigate to ensure all CAs disclosed have the correct CDPs listed | Mitigate | Root Cause #1 | Complete internal review to ensure that all posted CRLs in CCADB are properly disclosed. To date we have only identified 12 CAs. | 2026-02-20 | In Progress |
| Add detection capabilities to ensure CRLs posted in CCADB are what we are publishing in Certificates | Detect | Root Cause #1 | Tools and/or processes in place to ensure we quickly detect and mitigate any future CDPs that are not disclosed in CCADB | 2026-02-20 | In Progress |
|
|
Assignee | |
Comment 10•1 month ago
|
||
Weekly Status Update
Action Item #4 has been completed. We are actively working to complete the repair item #3 by the specified due date.
| Action Item | Kind | Corresponding Root Cause(s) | Evaluation Criteria | Due Date | Status |
|---|---|---|---|---|---|
| #1 - Update CRL JSON Array in CCADB for the 12 CAs in question | Mitigate | Root Cause # 1 | 12 CAs are updated in CCADB with JSON Array of CRL URLs that are published in issued certificates. | 2025-12-19 | Complete |
| #2 - Update process to post CRL JSON Arrays in CCADB to avoid incidents like we had in Sept 2025 (improper JSON issue) | Mitigate | Root Cause # 1 | Internal process for team to follow is updated and documented. This is specific to the issue related to improper JSON Array formatting. | 2025-12-19 | Complete |
| #3 - Investigate to ensure all CAs disclosed have the correct CDPs listed | Mitigate | Root Cause # 1 | Complete internal review to ensure that all posted CRLs in CCADB are properly disclosed. To date we have only identified 12 CAs. | 2026-02-20 | In Progress |
| #4 - Add detection capabilities to ensure CRLs posted in CCADB are what we are publishing in Certificates | Detect | Root Cause # 1 | Tools and/or processes in place to ensure we quickly detect and mitigate any future CDPs that are not disclosed in CCADB. | 2026-02-20 | Complete |
|
|
Assignee | |
Comment 11•1 month ago
|
||
Weekly Status Update
We are actively working on all repair items mentioned in the Full incident report. No new changes at this time
|
|
Assignee | |
Comment 12•1 month ago
|
||
Weekly Status Update
We have completed the work related to action item #3. All action items associated to this bug are now complete and we will be posting our closure report soon.
| Action Item | Kind | Corresponding Root Cause(s) | Evaluation Criteria | Due Date | Status |
|---|---|---|---|---|---|
| #1 - Update CRL JSON Array in CCADB for the 12 CAs in question | Mitigate | Root Cause # 1 | 12 CAs are updated in CCADB with JSON Array of CRL URLs that are published in issued certificates. | 2025-12-19 | Complete |
| #2 - Update process to post CRL JSON Arrays in CCADB to avoid incidents like we had in Sept 2025 (improper JSON issue) | Mitigate | Root Cause # 1 | Internal process for team to follow is updated and documented. This is specific to the issue related to improper JSON Array formatting. | 2025-12-19 | Complete |
| #3 - Investigate to ensure all CAs disclosed have the correct CDPs listed | Mitigate | Root Cause # 1 | Complete internal review to ensure that all posted CRLs in CCADB are properly disclosed. To date we have only identified 12 CAs. | 2026-02-20 | Complete |
| #4 - Add detection capabilities to ensure CRLs posted in CCADB are what we are publishing in Certificates | Detect | Root Cause # 1 | Tools and/or processes in place to ensure we quickly detect and mitigate any future CDPs that are not disclosed in CCADB | 2026-02-20 | Complete |
|
|
Assignee | |
Comment 13•1 month ago
|
||
Report Closure Summary
-
Incident description:
Between September 23, 2025 and December 19, 2025, Microsoft PKI Services disclosed CRL information in CCADB that did not fully match the CRL Distribution Point (CDP) URLs published in certificates issued by twelve newly created CAs. Specifically, we disclosed full CRL URLs in CCADB rather than the JSON Array of Partitioned CRL URLs that were actually published in issued certificates, resulting in non-compliance with Section 6.2 of the CCADB Policy. -
Incident Root Cause(s):
Microsoft PKI Services incorrectly interpreted Section 6.2 of the CCADB Policy when updating CCADB records in September 2025. Following a previous incident (Bug 1990801) involving improperly formatted JSON arrays, we chose to simplify by posting only full CRL URLs in CCADB. While Section 6.2 allows either full CRL URLs or partitioned CRL JSON arrays, we failed to recognize that the section as a whole requires disclosure of the actual CRL URLs that appear in issued certificates. Since our certificates contained partitioned CRL URLs, those specific URLs needed to be disclosed in CCADB via the JSON Array format. -
Remediation description:
On December 19, 2025, Microsoft PKI Services updated all twelve affected CAs in CCADB to include the complete JSON Array of Partitioned CRL URLs that are published in issued certificates. We also updated our internal processes for posting CRL information in CCADB to ensure proper disclosure format going forward. Additionally, we initiated a comprehensive review of all CAs disclosed in CCADB to verify correct CRL disclosure and implemented detection capabilities to identify and prevent future mismatches between CCADB disclosures and certificate contents. This work was completed between December and February. -
Commitment summary:
Microsoft PKI Services commits to maintaining ongoing monitoring and validation processes to ensure CRL disclosures in CCADB remain aligned with the CRL URLs published in issued certificates. We have implemented detection tools and process checks as part of our continuous compliance program to identify and remediate any future discrepancies promptly, supporting our commitment to transparency and adherence to CCADB Policy requirements.
All Action Items disclosed in this report have been completed as described, and we request its closure.
|
|
||
Comment 14•1 month ago
|
||
This is a final call for comments or questions on this Incident Report.
Otherwise, it will be closed on approximately 2026-03-02.
|
|
Assignee | |
Comment 15•1 month ago
|
||
Weekly Status Update
The closure report associated to this bug has been submitted. Please close if no other comments are provided.
|
|
||
Updated•1 month ago
|
Description
•