GlobalSign incident: OCSP Delegated Responder certificates missing id-pkix-ocsp-nocheck

GlobalSign disclosed that it had issued one or more OCSP Delegated Responder certificates without the required id-pkix-ocsp-nocheck response. The report was originally raised on mozilla.dev.security.policy and then tracked in Bugzilla by Mozilla and GlobalSign. GlobalSign said it investigated the issue, stopped including the OCSP Signing EKU in newly generated issuing CAs, and began revoking affected CA certificates in batches. The thread records multiple revocation and key-destruction actions through 2020 and 2021, along with an ISAE3000 report covering the non-performance of OCSP signing for the affected CAs. GlobalSign stated in January 2022 that the attached ISAE3000 Type II report concluded its remedial activities and that the incident could now be closed.

1. 2020-07-01 Security issue involving OCSP Signing EKU in some issuing CAs was disclosed on mozilla.dev.security.policy.
2. 2020-07-08 First batch of affected issuing CAs was revoked.
3. 2020-07-11 Trusted Root hierarchies were revoked after a 72-hour postponement.
4. 2020-07-28 Another batch of affected issuing CAs was revoked and some keys were destroyed.
5. 2021-01-20 Additional affected CAs were revoked.
6. 2021-02-24 Further affected CAs were revoked.
7. 2021-04-21 Final remaining CAs in the plan were due to be revoked or destroyed.
8. 2022-01-17 GlobalSign attached an ISAE3000 Type II report and said the incident could be closed.

1. 2020-07-02 Community commenter — Ryan Sleevi reported that GlobalSign had issued OCSP Delegated Responders without id-pkix-ocsp-nocheck and cited an example certificate.
2. 2020-07-02 GlobalSign nv-sa — GlobalSign confirmed receipt of the report and said it was investigating.
3. 2020-07-03 GlobalSign nv-sa — GlobalSign said it recognized the security issue, was working on a remediation plan, and would share an initial plan in Bugzilla.
4. 2020-07-08 GlobalSign nv-sa — GlobalSign reported the first revocation batch and said it planned to revoke additional CAs.
5. 2020-07-16 GlobalSign nv-sa — GlobalSign posted a detailed incident timeline, said it had ceased including the OCSP Signing EKU in newly generated issuing CAs, and described its remediation and audit plans.
6. 2020-07-17 Mozilla representative — Ben Wilson set the matter for a report-back update on or before 15-Oct-2020.
7. 2020-07-22 GlobalSign nv-sa — GlobalSign corrected one revocation date and said it would post a new overview after the July 28 activities.
8. 2020-07-29 Mozilla representative — Ben Wilson said revoked and CCADB-updated CA certificates would be automatically added to OneCRL and asked GlobalSign to separate TLS-capable from non-TLS-capable issuers for the remaining entries.
9. 2020-08-04 GlobalSign nv-sa — GlobalSign listed more revoked CAs and said backup copies of keys would be destroyed in the upcoming two weeks.
10. 2021-01-12 Mozilla representative — Ben Wilson said the bug could probably be closed and progress tracked in Bug 1651447.
11. 2021-01-12 GlobalSign nv-sa — GlobalSign asked to keep this bug open for customer communication and said it would use Bug 1651447 for the 7-day revocation tracking.
12. 2021-04-27 GlobalSign nv-sa — GlobalSign said the last remaining CA had been actioned and that audit reporting was ongoing.
13. 2022-01-17 GlobalSign nv-sa — GlobalSign attached the final ISAE3000 Type II report and said the remedial activities were concluded.