Asseco DS / Certum: Incorrect OCSP response encoding

RESOLVED FIXED Asseco Data Systems S.A.

This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update. Always refer to the official Bugzilla thread as the authoritative source. If you spot an inaccuracy, let me know via the contact form.

AI Summary

This case involves Asseco Data Systems S.A. (Certum) disclosing an issue related to incorrect encoding in OCSP responses. The problem was identified when a user reported that the OCSP response included an unnecessary encoding of the ResponseData.version field, violating RFC6960. Certum acknowledged the issue, investigated it, and implemented a fix by correcting the encoding in their OCSP Responder. They also provided a detailed timeline of their actions and confirmed that they ceased issuing OCSP responses with the invalid encoding. The case has been resolved with the implementation of additional linting measures to prevent similar issues in the future.

Model: gpt-4o-mini Generated: 2026-06-13 21:22 UTC Revised: 2026-06-16 18:07 UTC Confidence: 0.85 27 comments

Chronology

2020-05-20 Bugzilla bug created regarding incorrect OCSP response encoding.
2020-05-21 Certum confirmed the issue and implemented a fix.
2020-05-26 Certum provided a detailed incident report.
2020-08-27 Bug closed after confirming resolution and preventive measures.

Thread Activity

2020-05-20 Hezmatt representative — Created a bug report about invalid OCSP response encoding.
2020-05-21 Asseco Data Systems S.A. — Certum acknowledged the issue and began investigating.
2020-05-21 Asseco Data Systems S.A. — Certum confirmed the fix was implemented.
2020-05-26 Asseco Data Systems S.A. — Certum provided a detailed incident report.
2020-08-27 Mozilla representative — Indicated intention to close the bug.

Participants

Hezmatt representative Asseco Data Systems S.A. Community commenter Mozilla representative

External References

Original Bugzilla Case

Similar Local Cases

#1667684 RESOLVED Self Reported Incident Opened 2020-09-27 · Closed 2023-02-22 · 100% similar

Asseco DS / Certum: Failure to provide a preliminary report within 24 hours.

AI Summary CA Owner

#1709392 RESOLVED Self Reported Incident Certificate Misissuance Opened 2021-05-04 · Closed 2023-02-22 · 100% similar

Asseco DS / Certum: Invalid stateOrProvinceName field (recurrent incident)

AI Summary CA Owner

#1711208 RESOLVED Self Reported Incident Certificate Misissuance Opened 2021-05-14 · Closed 2023-02-22 · 100% similar

Asseco DS / Certum: Incorrect localityName

AI Summary CA Owner

#1409766 RESOLVED Ca Certificate Compliance Self Reported Incident Certificate Misissuance Opened 2017-10-18 · Closed 2023-02-22 · 98% similar

Asseco DS / Certum: CAA Mis-Issuance on CNAME pointing directly to restrictive CAA record

AI Summary CA Owner

#1832093 RESOLVED Self Reported Incident Certificate Misissuance Opened 2023-05-09 · Closed 2023-06-02 · 97% similar

Asseco DS / Certum: Subordinate certificates with sequential serial number

AI Summary CA Owner

#1815355 RESOLVED Ca Certificate Compliance Self Reported Incident Opened 2023-02-07 · Closed 2023-08-16 · 91% similar

Asseco DS / Certum: Cross-Signed non-EV-audited root with an EV-enabled root

AI Summary CA Owner

#1511459 RESOLVED Self Reported Incident Opened 2018-11-30 · Closed 2023-02-22 · 87% similar

Asseco DS / Certum: Corrupted certificates

AI Summary CA Owner

#1563579 RESOLVED Ca Certificate Compliance Self Reported Incident Opened 2019-07-04 · Closed 2023-02-22 · 81% similar

Sectigo: Failure to provide timely incident reports

AI Summary CA Owner