IdenTrust: Non-BR-Compliant OCSP Responders

This case concerns IdenTrust OCSP responder behavior that was reported as non-compliant with Mozilla Baseline Requirements. The requirement cited was BR 4.9.10, which states OCSP responders MUST NOT respond with a “good” status for unissued certificates, with an effective date of 2013-08-01. The issue was raised in the mozilla.dev.security.policy forum, and the bug was used to record IdenTrust’s incident report. IdenTrust stated it was notified on August 29, 2017, reviewed the reported violation for DST ACES CA X6, verified the behavior, and formulated and executed a remediation plan. IdenTrust reported that it completed remediation on August 30, 2017 and stopped sending OCSP responses in violation of BR 4.9.10 as of August 30, 2017. IdenTrust also stated the non-compliant AIA OCSP URL was only present in the subordinate CA (IdenTrust ACES CA 1) certificate and was inadvertently missed during an OCPS update activity in 2013, and that the OCSP software accessible at that AIA OCSP URL was permanently deprecated. The bug was resolved as FIXED, and Gerv indicated that since the PKI was now obsolete there was nothing left to do in the bug.

1. 2017-08-29 IdenTrust was notified of a reported BR 4.9.10 violation for an OCSP responder configuration and began reviewing and verifying the issue for DST ACES CA X6.
2. 2017-08-30 IdenTrust completed remediation and stopped sending OCSP responses in violation of BR 4.9.10 for the identified CA certificate.
3. 2017-09-08 Mozilla CA Program bug was opened to record IdenTrust’s incident report for the OCSP responder non-compliance.
4. 2018-01-11 Mozilla indicated the PKI was obsolete and there was nothing left to do in the bug.

1. 2017-09-08 Community commenter — Requested an incident report in the bug, citing BR 4.9.10 and noting the problem was fixed as of 2017-08-31.
2. 2017-09-21 Community commenter — Asked Vishvas to provide the incident report for the incident.
3. 2017-09-22 Community commenter — Provided an incident report including notification date (Aug 29, 2017), remediation timeline, confirmation that non-compliant OCSP responses stopped as of Aug 30, 2017, and details about the problematic certificate and cause.
4. 2017-10-13 Community commenter — Asked how the non-compliant OCSP URL was missed and questioned why it was not discovered earlier.
5. 2017-11-28 Community commenter — Requested an update after the bug had been waiting for two months.
6. 2018-01-05 Community commenter — Explained that a PKI roll over occurred during the period and that the non-compliant OCSP URL was only present in the subordinate CA AIA; stated the PKI expired with DST Root CA X6 expiration on Nov 20.
7. 2018-01-11 Community commenter — Stated he was not impressed by the records but that since the PKI was obsolete there was nothing left to do in the bug.