Open Bug 2083502 Opened 3 days ago Updated 6 hours ago

DigiCert: cRLNumber not increasing within one CRL scope

Categories

(CA Program :: CA Certificate Compliance, task)

Product:
CA Program
Component:
CA Certificate Compliance
Type:
task

Tracking

(Not tracked)

Status:
ASSIGNED

People

(Reporter: dcbugzillaresponse, Assigned: dcbugzillaresponse)

Details

(Whiteboard: [ca-compliance] [crl-failure])

Preliminary Incident Report

Summary

  • Incident description: A third party reported that a DigiCert Issuing CA disclosed two CRLs in CCADB. The report notes they are full and complete CRLs with the same scope and the same issuer, and they share one cRLNumber sequence. The report notes that, in several observed instances, the CRLs provided a decrease in cRLNumber between versions.

    The report observes that BR Section 7.2.2 requires the CRLNumber extension to "convey a strictly increasing sequence." RFC 5280 Section 5.2.3 defines the CRL number as "a monotonically increasing sequence number for a given CRL scope and CRL issuer."

  • Relevant policies:

    • TLS Baseline Requirements, v2.3.0, 7.2.2

    • RFC 5280 Section 5.2.3

  • Source of incident disclosure: Third party reported

Assignee: nobody → dcbugzillaresponse
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true
Whiteboard: [ca-compliance] [crl-failure]
You need to log in before you can comment on or make changes to this bug.