Trustis: Non-Br-Compliant OCSP Responder

This case concerns Trustis's non-compliance with the Baseline Requirements regarding OCSP responses. The issue was identified when it was discovered that OCSP responders were incorrectly returning a 'good' status for invalid serial numbers. Trustis initiated an investigation and confirmed that their software did not support the requirement. They ceased issuing certificates and planned to migrate their OCSP service to a compliant infrastructure. An incident report was provided detailing the timeline of actions taken and confirming that no non-compliant certificates were issued after January 7, 2018. The issue has been resolved, and Trustis is no longer on the list of non-compliant responders.

1. 2017-12-19 Trustis became aware of the OCSP issue through a Bugzilla notice.
2. 2018-01-10 Trustis confirmed the need for remediation and planned to migrate OCSP services.
3. 2018-03-19 Trustis completed the investigation and remediation of the OCSP issue.
4. 2018-04-12 Trustis confirmed that there are no active certificates relying on the old OCSP infrastructure.

1. 2017-12-19 Fastly representative — The OCSP responders for Trustis were returning a good response for an invalid serial number.
2. 2017-12-20 Trustis representative — Trustis is investigating the issue and will provide a compliant incident report.
3. 2018-01-10 Trustis representative — Trustis found that the current software does not support the requirement and will migrate OCSP services.
4. 2018-03-19 Trustis representative — Trustis completed the investigation and compiled an incident report.
5. 2018-04-12 Trustis representative — Trustis confirmed that there are no active certificates relying on the old OCSP infrastructure.