Currently, the CCADB probe checks that the list of CRLs present in CCADB matches the regex ^http://[a-z0-9-]+\.c\.lencr\.org/\d+\.crl$. Essentially a formatting check.
It does not check whether all CRLDPs that could be embedded are present in CCADB. For instance, if the number of CRL shards is 4, and we only disclosed shards 1, 2, and 3, the prober would succeed.
We could make this mistake, for instance, we expanded the number of CRL shards but didn't update CCADB. A similar event took place in https://bugzilla.mozilla.org/show_bug.cgi?id=2007116#c1.
Currently, the CCADB probe checks that the list of CRLs present in CCADB matches the regex
^http://[a-z0-9-]+\.c\.lencr\.org/\d+\.crl$. Essentially a formatting check.It does not check whether all CRLDPs that could be embedded are present in CCADB. For instance, if the number of CRL shards is 4, and we only disclosed shards 1, 2, and 3, the prober would succeed.
We could make this mistake, for instance, we expanded the number of CRL shards but didn't update CCADB. A similar event took place in https://bugzilla.mozilla.org/show_bug.cgi?id=2007116#c1.