← Apple Inc. cases
Bugzilla #1677234
Certificate Problem Report
Apple: OCSP availability 2020-11-12
RESOLVED
FIXED
Apple Inc.
AI Summary
On November 12, 2020, Apple experienced diminished availability of its OCSP services, affecting the ability to verify certificate statuses. The issue was traced to a CDN that was non-responsive to incoming requests, leading to a significant increase in failed OCSP queries. Apple confirmed that this incident did not impact certificate issuance. The Apple CA team took immediate action to identify the cause and engaged with the CDN to implement mitigations, which restored service by the afternoon of the same day. Subsequent improvements to monitoring and infrastructure were planned to prevent future occurrences.
Chronology
- Initial decline in successful OCSP queries begins
- Monitoring alert received due to timeouts in certificate status services
- CDN identified as cause of diminished availability
- Service recovery begins after CDN mitigations
Participants
certification_authority@apple.com
ryan.sleevi@gmail.com
bwilson@mozilla.com
External References
Similar Local Cases
Apple: EV Certificate Approver Authorization
Apple: Public Key Reuse
Apple: Revocation Delay for TLS certificates issued outside the TTL of the CAA record
Apple: TLS certificates issued outside the TTL of the CAA record
Apple: Test website certificates expired
Apple: OCSP responders return responses with incorrect issuer
Apple: CRLs for dormant CAs will not be populated in CCADB
Apple: OCSP responders return ‘unknown’ for valid S/MIME and TLS certificates