StartCom OCSP responder returns "unknown" for newly issued certificates

This case concerns StartCom's OCSP responder returning "unknown" for recently issued certificates, which caused Firefox to block access to affected sites. The bug was opened by a third party after observing that replacing an expiring certificate could leave the new certificate unrecognized for hours or even up to a day. Mozilla comments in the thread explain that the CA/B Forum requirements were changed so CAs must respond "unknown" for certificates they do not yet know about, and that StartCom needed to fix its responder so it would learn about issued certificates more quickly. The thread also notes that the issue recurred over time and that StartCom was assigned the bug for follow-up. The bug was later resolved with WONTFIX, and no fix is recorded in the thread.

1. 2014-05-06 A user reports that StartCom's OCSP responder returns "unknown" for newly issued certificates.
2. 2014-08-28 Mozilla explains that the OCSP behavior is required for security and that StartCom needs to improve responder update timing.
3. 2017-03-20 The bug is resolved WONTFIX.

1. 2014-05-06 Iserv representative — Reported that StartSSL's OCSP server can take hours to update, causing "unknown" responses for new certificates.
2. 2014-08-28 Briansmith representative — Explained that Mozilla requires "unknown" responses for unknown certificates and said StartCom needs to fix its OCSP responder timing.
3. 2014-09-29 Mozilla representative — Assigned the issue to Eddy as a StartCom issue.
4. 2017-03-20 Mozilla representative — Resolved the bug, noting that if StartCom becomes trusted again, they are unlikely to have the same issues.