DigiCert: Apple: Precertificates without corresponding certificates return OCSP value of "unknown"

The case was opened as an incident report about OCSP responder behavior for precertificates that do not have corresponding certificates. The reporter stated that Apple’s OCSP responders return the OCSP status value “unknown” for such precertificates, and identified one precertificate that did not result in a corresponding certificate (linked via crt.sh). The reporter also said Apple updated its OCSP responders to respond “good” for that precertificate and that a long-term fix was in progress. After discussion on the mozilla.dev.security.policy forum, the reporter resolved the incident as INVALID. The bug is currently marked RESOLVED with resolution INVALID.

1. 2019-09-19 A CA program incident report was filed regarding OCSP status handling for precertificates without corresponding certificates.
2. 2019-10-05 The reporter marked the incident report as INVALID after forum discussion.

1. 2019-09-19 Community commenter — Wayne Thayer reported that Apple’s OCSP responders return “unknown” for precertificates without corresponding certificates, identified a specific precertificate, and stated Apple updated responders to return “good” for that precertificate while a long-term fix was in progress.
2. 2019-10-05 Community commenter — Wayne Thayer resolved the incident as INVALID based on the outcome of the mozilla.dev.security.policy discussion.