2081685 - D-Trust: Discrepancy in CRL URL Disclosures

Status: ASSIGNED

(CA Program :: CA Certificate Compliance, task)

Description

[Ana Laura Martorano]

Preliminary Incident Report

Summary

Incident description:

On 2026-10-12 at 13:54:17 UTC, D-Trust GmbH received a third-party Certificate Problem Report concerning discrepancies between self-signed certificate and cross-certificate (sharing the same subject and key) for two D-Trust Root CAs regarding the disclosure of Certificate Revocation List Uniform Resource Locators (CRL URLs) in the Common CA Database (CCADB).

The following records were reported:

CCADB ID	Certificate Name	Certificate Record Type
A007473	D-TRUST BR Root CA 1 2020	Root Certificate (self-signed)
A012536	D-TRUST BR Root CA 1 2020	Intermediate Certificate (Cross-Certificate)
A010974	D-TRUST BR Root CA 2 2023	Root Certificate (self-signed)
A012537	D-TRUST BR Root CA 2 2023	Intermediate Certificate (Cross-Certificate)

For both A012536 and A012537 the parent certificate record is D-TRUST Root Class 3 CA 2 2009 (A000126).

CCADB Policy v2.1, Section 6.2 Certificate Revocation List Disclosures requires that CA Owners MUST disclose, in a JSON array, the complete set of distinct HTTP URLs appearing in the crlDistributionPoints extension of the unexpired certificates issued by that CA.

The third-party report states that for the two mentioned CAs the entries in the field JSON Array of All Full CRL URLs do not match between self-signed Root CA and Intermediate CA (cross-certificate).

We have started an investigation with the following preliminary results.
For each of the CAs listed above we have checked the entries in the CCADB and found:

CCADB ID	Certificate Name	Certificate Record Type	JSON Array of All Full CRL URLs
A007473	D-TRUST BR Root CA 1 2020	Root Certificate (self-signed)	["http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl","http://cdn.d-trust-cloudcrl.net/crl/d-trust_br_root_ca_1_2020.crl"]
A012536	D-TRUST BR Root CA 1 2020	Intermediate Certificate (Cross-Certificate)	["http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl"]
A010974	D-TRUST BR Root CA 2 2023	Root Certificate (self-signed)	["http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl","http://cdn.d-trust-cloudcrl.net/crl/d-trust_br_root_ca_2_2023.crl"]
A012537	D-TRUST BR Root CA 2 2023	Intermediate Certificate (Cross-Certificate)	["http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl"]

As a first Action Item, D-Trust has aligned

• A012536 with A007473 and
• A012537 with A010974,

i.e. adjusted the JSON Array of All Full CRL URLs for the cross-certificates to the ones that are set for the self-signed Root CA certificates.

Known impact:
At the time of this Preliminary Incident Report, two CAs, each with two CA certificate records are known to show the mismatch described above. We are reviewing all applicable D-Trust CCADB certificate records to determine whether additional records are affected. The scope stated in this Preliminary Incident Report therefore represents the currently known impact and is not yet considered final.

The certificate issuance process is not impacted and no mis-issuance happened. Therefore, certificate issuance was not halted.

Containment status:
The verification of the incident is currently considered ongoing. The mentioned CCADB records require further investigation and the scope review has not yet been completed. We will consider the issue contained once the affected records are corrected in a publicly available CCADB export.

Relevant policies:

CCADB Policy v2.1, Section 6.2 Certificate Revocation List Disclosures

Quote: CA Owners MUST disclose, in a JSON array,the complete set of distinct HTTP URLs appearing in the crlDistributionPoints extension of the unexpired certificates issued by that CA.

Source of incident disclosure:

Third Party Reported.

D-Trust GmbH received the Certificate Problem Report on 2026-10-12 at 13:54:17 UTC.