GRCA: Signing SHA-1 OCSP responses with unconstrained certificate

The Government of Taiwan's Government Root Certification Authority (GRCA) was reported for signing OCSP responses with SHA-1 using an unconstrained certificate, violating Mozilla's Root Store Policy. The issue was identified through a Bugzilla report on September 23, 2017. GRCA acknowledged the problem, stating that a subordinate CA, HCA, misunderstood the SHA-1 deprecation policy. They took corrective actions, including stopping the use of SHA-1 for OCSP responses by September 30, 2017, and have committed to improving compliance communication with subordinate CAs. The bug has been resolved as the issue was fixed.

1. 2017-09-23 Incident identified via Bugzilla report.
2. 2017-09-30 HCA stopped generating SHA-1 OCSP responses.

1. 2017-09-07 Mm representative — Reported SHA-1 OCSP signing issue to GRCA.
2. 2017-09-08 Mozilla representative — Requested prompt acknowledgment and incident report from GRCA.
3. 2017-09-26 Ndc representative — GRCA provided an incident report detailing the timeline and corrective actions.
4. 2017-10-12 Ndc representative — Confirmed that SHA-1 OCSP signing has ceased.
5. 2017-10-13 Mozilla representative — Confirmed that the bug can be made public.