Camerfirma: Non-BR-Compliant OCSP Responders

This case concerns OCSP responder behavior for the InfoCert Organization Validation CA 3 and the Intesa Sanpaolo Organization Validation CA intermediates. The OCSP responders were returning a 404 for a GET request and returning a “good” response for an invalid serial number, which Wayne Thayer cited against CA/Browser Forum Baseline Requirements section 4.9.10 (effective 2013-08-01). Camerfirma stated it had been made aware of the problem and that its technical team corrected the GET-method issue for both subCAs and corrected the “good” response for unissued certificates for the InfoCert subCA. Camerfirma also reported that the Intesa Sanpaolo OCSP service issue was solved on 2017-12-22. After Wayne confirmed the OCSP responders no longer appeared on the crt.sh OCSP responder report, he marked the issue as resolved. Camerfirma added procedural controls including an annual BR self-assessment for the subCAs and daily checks of the crt.sh OCSP responder report, and it described adding a PKI senior expert to manage BR/CA Forum/CCADB self-assessment and communications.

1. 2017-12-19 Wayne Thayer reported OCSP responder non-compliance against BR 4.9.10 and requested an incident report.
2. 2017-12-20 Camerfirma reported that the GET-method issue was fixed for both subCAs and the unissued-certificate “good” response was fixed for the InfoCert subCA.
3. 2017-12-22 Camerfirma reported that the Intesa Sanpaolo OCSP service issue was solved.
4. 2018-01-03 Wayne confirmed the OCSP responders no longer appeared on the crt.sh report and requested additional incident-report details.
5. 2018-01-04 Camerfirma described procedural and technical steps (annual BR self-assessment and daily crt.sh checks) to ensure ongoing compliance.
6. 2018-01-04 Wayne marked the issue as resolved.

1. 2017-12-19 Fastly representative — Reported that the OCSP responders returned 404 for GET and “good” for an invalid serial number, cited BR 4.9.10 requirements, and requested an incident report.
2. 2017-12-20 AC Camerfirma, S.A. — Said the technical team corrected the GET-method issue for both subCAs and the unissued-certificate “good” response for the InfoCert subCA, and stated Intesa Sanpaolo would be solved by 2017-12-22.
3. 2017-12-26 AC Camerfirma, S.A. — Confirmed that the Intesa Sanpaolo OCSP service issue was solved on 2017-12-22.
4. 2018-01-03 Fastly representative — Confirmed the responders no longer appeared on crt.sh and asked for more incident-report information about ensuring no other BR failures and ensuring future compliance.
5. 2018-01-04 AC Camerfirma, S.A. — Stated they added annual BR self-assessment for the subCAs and daily checks of the crt.sh OCSP responder report, and described adding a PKI senior expert to manage BR/CCADB/self-assessment impacts.
6. 2018-01-04 Fastly representative — Marked the issue as resolved.