← Visa cases
Bugzilla #1398261
Self Reported Incident
Visa: Non-BR-Compliant OCSP Responders
RESOLVED
FIXED
Visa
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
This case addresses compliance issues with Visa's OCSP responders, which were found to be non-compliant with the CA/Browser Forum Baseline Requirements (BRs). The issue was initially reported by Kathleen Wilson, highlighting that OCSP responders must not respond with a 'good' status for unissued certificates. Visa investigated the problem, escalated it to their vendor, and ultimately decided to transition to a new OCSP infrastructure that meets compliance requirements. The issue has been resolved with the successful deployment of a new solution, and Visa has committed to improving their compliance processes moving forward.
Chronology
- Initial report of non-compliance with OCSP responders
- New OCSP solution successfully deployed and validated
Thread Activity
- Mozilla representative — Problems have been found with OCSP responders for this CA, and reported in the mozilla.dev.security.policy forum.
- Visa — We reached a conclusion that our current vendor is unable to provide us a workable solution.
- Visa — The Visa OCSP Service is responding properly to all validation requests.
Participants
Mozilla representative
Visa
Community commenter
External References
Similar Local Cases
SHA-1 issuance by Visa root
Visa: Non-BR-Compliant Certificate Issuance
GlobalSign: Non-BR-Compliant Certificate Issuance -- RSA key smaller than 2048 bits
NetLock: Non-BR-Compliant Certificate Issuance
DigiCert / Inteso San Paulo: Double dot characters
DigiCert / Telecom Italia: Several Problems
SECOM: Non-BR-Compliant OCSP Responders
Kamu SM: Non-BR-Compliant Certificate Issuance