2084776 - D-Trust: Published Certificate Problem Report mechanism unavailable

Status: ASSIGNED

(CA Program :: CA Certificate Compliance, task)

Description

[trusten]

Attachment: image.jpeg

On 2026-10-21 at 20:19 UTC, D-Trust's English Certificate Problem Report page displayed:

The form is currently deactivated.

Its German counterpart displayed:

Die Formulare sind derzeit deaktiviert.

English: https://www.d-trust.net/en/support/reporting-certificate-problem
German: https://www.d-trust.net/de/support/meldung-eines-zertifikatsproblems

CP v6.2 section 1.5.2 directs third parties reporting problems with publicly trusted TLS certificates to this form and requires its use. TSPS v3.2 section 4.9.12 also requires the disclosed reporting mechanism for TLS private-key compromise reports.

CCADB's All Problem Reporting Mechanisms Report, dated 2026-10-21, lists the same English URL as D-Trust's sole disclosed problem reporting mechanism. It lists no alternative email address or telephone number for D-Trust:
https://ccadb.my.salesforce-sites.com/ccadb/AllProblemReportingMechanismsReport

Neither reporting page provides fallback instructions for submitting a Certificate Problem Report while the form is disabled. General contact, data-protection and sales addresses elsewhere on the page are not identified as alternative Certificate Problem Report mechanisms. The published instructions therefore cannot be followed.

TLS BR v2.3.1 section 4.9.3 requires continuous 24x7 acceptance of and response to revocation requests and Certificate Problem Reports. It also requires clear, publicly disclosed reporting instructions for subscribers, relying parties and other third parties. Disabling the required form without disclosing an available alternative appears inconsistent with these requirements. This can delay urgent reporting of key compromise or misissuance.

It would help to understand:

• When was the form disabled, and why?
• What mechanism, if any, remained available for third-party Certificate Problem Reports during the outage, where were its instructions published, and how was its 24x7 handling maintained?
• Why was no fallback published on the reporting pages or in CCADB, and how will intake be maintained during future outages?
• What monitoring detects failures of the reporting mechanism, including failures to accept a submission?
• What evidence is available about attempted reports that were rejected, lost or not received?

Policy sources:
https://www.d-trust.net/internet/files/D-TRUST_CP.pdf
https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
https://cabforum.org/working-groups/server/baseline-requirements/documents/CA-Browser-Forum-TLS-BR-2.3.1.pdf

Comment 1

[Ana Laura Martorano]

(In reply to trusten from comment #0)

Thank you for reporting this problem. We will provide you with an update once our review has been completed.

Comment 2

[Ana Laura Martorano]

Preliminary Incident Report

Summary

• Incident description: As a security precaution, the D-TRUST certificate problem reporting webpage was switched to static pages to prevent potential exploitation of a PHP vulnerability. This resulted in the Certificate Problem Report webform being unavailable. The impact on the submission of certificate problem reports during the affected period is currently under investigation.
• Relevant policies: TLS BR v2.3.1 section 4.9.3; D-TRUST Trust Service Practice Statement (TSPS) v3.2, Section 4.9.12; D-TRUST Certificate Policy (CP) v6.2, Section 1.5.2
• Source of incident disclosure: Third Party Reported