Consorci AOC OCSP responders were not BR-compliant for unknown certificates
This case concerns non-BR-compliant OCSP responders operated by Consorci AOC (CATCert). The bug was opened after Mozilla was informed that the CA’s OCSP responders were returning a “good” status for unissued certificates, which violates the Baseline Requirements. Consorci AOC said the affected legacy sub-CAs were no longer issuing SSL/EV certificates, and later stated that its root OCSP responder and the remaining relevant responders were fixed or moved toward compliance. Mozilla also required the non-compliant subordinate CAs to be added to OneCRL, and the CA reported that those additions were requested and then added. The thread later recorded a recurrence of the problem in June 2018, after which Consorci AOC filed a separate incident report and said the issue was solved. The bug was ultimately marked RESOLVED/FIXED.
- Mozilla reported that Consorci AOC OCSP responders returned “good” for unissued certificates.
- Consorci AOC said the EC-ACC root OCSP responder was working in conformity with the BRs.
- Mozilla said the non-compliant CA certificates had been added to OneCRL.
- Consorci AOC reported the OCSP issue had recurred and said it was solved that day.
- Mozilla representative — Kathleen Wilson reported the OCSP problem, cited BR section 4.9.10, and asked for an incident report.
- Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) — Francesc Ferrer said the affected legacy CAs were no longer issuing SSL/EV certificates and listed the problematic CA names and OCSP URIs.
- Fastly representative — Wayne Thayer said the root and subordinate CAs were not BR-compliant and asked for fixes or OneCRL removal.
- Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) — Francesc Ferrer said Consorci AOC had requested OneCRL additions and planned to fix the root OCSP responder.
- Fastly representative — Wayne Thayer said the non-compliant CA certificates had been added to OneCRL and marked the bug resolved.
- Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) — Francesc Ferrer said monitoring detected the issue again and that it was solved at 8:00 CET.
- Fastly representative — Wayne Thayer quoted the incident report from bug 1467110 and questioned whether the backup OCSP system would remain BR-compliant.
- Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) — Francesc Ferrer said the redundant SAN was deployed and the backup system was configured to respond “Unknown” for not issued certificates.