Apple: OCSP responders return responses with incorrect issuer

Apple CA reported an incident where their OCSP responders were returning signed responses with incorrect issuers. The issue was identified on October 3, 2019, following a problem report submitted to their Problem Reporting Mechanism. Apple initiated an investigation and determined that the OCSP service was incorrectly signing responses with a default OCSP responder when it could not process requests. A fix was rolled out starting October 7, 2019, and completed by October 18, 2019. Apple has since improved their incident reporting processes and shared their OCSP test cases with the community.

1. 2019-10-03 Apple CA was notified of OCSP responders returning incorrect issuer responses.
2. 2019-10-07 Apple began rolling out a fix to the OCSP service.
3. 2019-10-18 The fix was completed and pushed to all OCSP servers.

1. 2019-10-11 Apple representative — Apple CA acknowledged the issue and began investigating.
2. 2019-10-18 Apple representative — Apple provided a detailed incident report and timeline of actions taken.
3. 2020-07-01 Apple representative — Apple obtained approval to share their OCSP test cases.