2012934 - Telia: Inccorrect CRL URL on a Root CA record in CCADB

Status: RESOLVED FIXED

(CA Program :: CA Certificate Compliance, task)

Description

[Antti Backman]

Full Incident Report

Incorrect CRL URL for Telia RSA Signing Root CA v3. This Self-signed Root CA is for dedicated document signing hierarchy (non-tls and non-smime) not yet included in any Root Program. This PKI hierarchy is not yet used for issuance of subscriber certificates.

Summary

• CA Owner CCADB unique ID: A000055
• Incident description:
  • Self-signed Root CA Certificate record for Telia RSA Signing Root CA v3 (CCADB ID: A012100) contains incorrect URL in Full CRL Issued By This CA -field.
  • Initial submission of Root CA record to CCADB had incorrect CRL URL.
• Timeline summary:
  • Non-compliance start date: 2025-02-14
  • Non-compliance identified date: 2026-01-28
  • Non-compliance end date: 2026-01-28
• Relevant policies:
  • CCADB Policy v2.0, section 6.2
• Source of incident disclosure:
  • Third Party Reported

Impact

• Total number of certificates:
  • N/A
• Total number of "remaining valid" certificates:
  • N/A
• Affected certificate types:
  • N/A
• Incident heuristic:
  • N/A
• Was issuance stopped in response to this incident, and why or why not?:
  • N/A
• Analysis:
  • N/A
• Additional considerations:
  • N/A

Timeline

• 2025-02-14
  • CCADB CASE closed to add affected Root CA Record to CCADB
• 2026-01-23 21:20 UTC
  • Notification received from Third Party Reporter to Telia CAs general / support email (cainfo@teli) informing an issue identified by newly introduced CRL Watch tool
• 2026-01-24 06:04 UTC
  • Acknowledge send back to the Third Party Reporter
• 2026-01-26 07:27 UTC
  • Response send back to the Third Party Reporter of verification made by Telia CA
• 2026-01-27 16:06 UTC
  • Further details provided by the Third Party Reporter
• 2026-01-28 05:20 UTC
  • With further details provided, Telia CA identified that CCADB record had incorrect URL for Telia RSA Signing Root CA v3, thus being in violation of the specified CCADB policy section
• 2026-01-28 05:25 UTC
  • CCADB Root record update case made to correct the URL
• 2026-01-28
  • This report was submitted

Related Incidents

Bug	Date	Description
2007216	2025-12-19	Similarly incorrect information in CCADB for the CRL URL
2007116	2025-12-19	Similarly incorrect information in CCADB for the CRL URL
2009542	2026-01-09	Similarly incorrect information in CCADB for the CRL URL
2007221	2025-12-19	Similarly incorrect information in CCADB for the CRL URL
2009539	2026-01-09	Similarly incorrect information in CCADB for the CRL URL
2009543	2026-10-09	Similarly incorrect information in CCADB for the CRL URL
2009545	2026-01-09	Similarly incorrect information in CCADB for the CRL URL
2007089	2025-12-19	Similarly incorrect information in CCADB for the CRL URL
2007098	2025-12-19	Similarly incorrect information in CCADB for the CRL URL
2007297	2025-12-22	Similarly incorrect information in CCADB for the CRL URL
2007105	2025-12-19	Similarly incorrect information in CCADB for the CRL URL
2007219	2025-12-19	Similarly incorrect information in CCADB for the CRL URL
2010885	2026-01-16	Similarly incorrect information in CCADB for the CRL URL

Root Cause Analysis

Contributing Factor #1: CRL URL incorrectly set on the initial submission to CCADB

• Description:
  • While adding the Root CA record to CCADB in February 2025, the url was incrrectly set on the Root CA record to point to existing CRL, but issued by other Root CA
• Timeline:
  • 30.1.2025, CASE opened in CCADB
  • 14.2.2026, CASE closed in CCADB to store the Root CA record in CCADB for Telia CA
• Detection:
  • Review of CCADB records while investigating the issue for this incident report
• Interaction with other factors:
  • N/A
• Root Cause Analysis methodology used:
  • N/A

Contributing Factor #1: Failed to detect the incorrect URL in monthly CCADB data reviews

• Description:
  • This issue was missed in periodic (at least on monthly basis) reviews of CCADB for Telia CA.
  • This specific Root CA has not been subject to any specific task / actions in between the initial submission to CCADB and the time this issue was identified by the Third Party Reporter.
• Timeline:
  • 30.1.2025, CASE opened in CCADB
  • 28.1.2026, CASE opened and submitted to CCADB to correct the CRL URL
• Detection:
  • Review of CCADB records while investigating the issue for this incident report
• Interaction with other factors:
  • N/A
• Root Cause Analysis methodology used:
  • N/A

Lessons Learned

• What went well:
• What didn’t go well:
  • Initial input for the Root CA record was incorrect
  • Periodic reviews of the CCADB information did not detect the issue
• Where we got lucky:
• Additional:
  • We thank the Third Party Reporter to identify the issue

Action Items

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Extend the CCADB update practice to have four eyes principle to verify data updates of CA records	Prevent	Root Cause # 1 and Root Cause # 2	Practice, related CCADB update checklist amended and changes made effective by Telia CA PKI Team	2026-02-10	Ongoing
Propose to CCADB Steering committee to implement CRL verification function in the CA record update UI in CCADB	Prevent	Root Cause # 1	Proposal submitted to CCADB support	2026-01-30	Ongoing

Appendix

Comment 1

[Antti Backman]

This action item completed by sending proposal to CCADB support email.

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Propose to CCADB Steering committee to implement CRL verification function in the CA record update UI in CCADB	Prevent	Root Cause # 1	Proposal submitted to CCADB support	2026-01-30	Completed

Comment 2

[Antti Backman]

This is our weekly update, pending action item progresses as expected and we so issues to complete as planned.

Comment 3

[Antti Backman]

This our weekly update

We have completed the last pending action item as planned

Action Item	Kind	Corresponding Root Cause(s)	Evaluation Criteria	Due Date	Status
Extend the CCADB update practice to have four eyes principle to verify data updates of CA records	Prevent	Root Cause # 1 and Root Cause # 2	Practice, related CCADB update checklist amended and changes made effective by Telia CA PKI Team	2026-02-10	Completed

We start to prepare closure report

Comment 4

[Antti Backman]

Report Closure Summary

• Incident description:
  • Incorrect CRL URL for Telia RSA Signing Root CA v3. This Self-signed Root CA is for dedicated document signing hierarchy (non-tls and non-smime) not yet included in any Root Program. This PKI hierarchy is not yet used for issuance of subscriber certificates.
• Incident Root Cause(s):
  • #1, While adding the Root CA record to CCADB in February 2025, the url was incrrectly set on the Root CA record to point to existing CRL, but issued by other Root CA
  • #2, Issue was missed in periodic (at least on monthly basis) reviews of CCADB for Telia CA.
• Remediation description:
  • Immediate remedation was done in CCADB through Add/Change Root Record CASE to change correct CRL Distribution Point URL for the Root CA Record
• Commitment summary:
  • In addition to action items completed in relation to this incident, we are considering possibilities to introduce tools to verify data correctness in our updates to CCADB prior submitting updates.

All Action Items disclosed in this report have been completed as described, and we request its closure.

Comment 5

[incident-reporting]

This is a final call for comments or questions on this Incident Report.

Otherwise, it will be closed on approximately 2026-02-25.