FND-1055 · Revocation · Production
Keyfactor CRL fetch intermittently times out
MediumAssigned
Detected vs required
Detected configuration
CRL fetch p95 = 9.8s (timeout 10s)
Required target
CRL fetch p95 < 3s
Impact
Soft-fail configuration may allow revoked certificates during timeouts.
Remediation guidance
Route CRL fetch via nearest proxy node and enable CRL caching.
Remediation workflow: ASSIGNED · Owner S. Patel · Due 2026-10-31 · OBMIG-253
Evidence
1 artefacts linked to this finding or its control on the affected system
- EVD-2010Checking CRL — WARNINGNetwork test11 Sept, 11:10Pending
Context
- Environment
- Production
- Control
- REV-002 — Keyfactor CRL connectivity validated
- Category
- Revocation
- Owner
- S. Patel
- Detected
- 13 Sept, 06:10
- Evidence ref
- cert-val metrics 2026-09-10
- Cutover blocker
- No
Linked tests
TST-011Checking CRLWARNING