2075258 - NETLOCK: Certificate Problem Report [CRL URL not disclosed in CCADB]

Status: ASSIGNED

(CA Program :: CA Certificate Compliance, task)

Description

[Roland]

Preliminary Incident Report

Summary

• Incident description:
  A third party reported that certificates issued by NETLOCK contain CRL Distribution Point URLs that are not disclosed in the CCADB for the corresponding issuing CA:

  • http://crl1.netlock.hu/index.cgi?crl=trustev3
  • http://crl2.netlock.hu/index.cgi?crl=trustev3
  • http://crl3.netlock.hu/index.cgi?crl=trustev3
  • http://crl1.netlock.hu/index.cgi?crl=qtrustev3
  • http://crl2.netlock.hu/index.cgi?crl=qtrustev3

  Example certificate provided by the reporter:

  • SHA-256: b4c00e250102703643acab3b938b75a356a7c231a5a2aaa32601e37aa880de2b
  • Serial: 5ea97e2a124bd7b4e913741f29fc
  • https://crt.sh/?sha256=b4c00e250102703643acab3b938b75a356a7c231a5a2aaa32601e37aa880de2b

  According to CCADB Policy §6.2, CA Owners must disclose these URLs to the CCADB at the earlier of within 7 days of the CA issuing the first certificate containing the URL, or within 4 hours of the CA revoking the first certificate containing the URL. NETLOCK has received the report and is investigating. A full incident report will follow.

• Relevant policies:

  • CCADB Policy §6.2 requirements for Certificate Revocation List disclosures.
  • CCADB incident reporting guidelines requiring disclosure of any non-compliance affecting CA certificates.

• Source of incident disclosure:
  Third Party Reported.