Actalis: Incorrect OCSP Delegated Responder Certificate

Actalis disclosed a compliance issue regarding the issuance of OCSP Delegated Responder certificates that lacked the required `id-pkix-ocsp-nocheck` extension, as mandated by the CA/Browser Forum Baseline Requirements. The issue was initially reported on the Mozilla dev security policy mailing list, prompting Actalis to investigate and acknowledge the problem. They have since outlined a detailed incident report, including a timeline of actions taken to address the issue, such as stopping the issuance of affected certificates and planning revocations. Actalis has committed to revoking the affected certificates and implementing additional monitoring controls to prevent future occurrences. The case has been resolved with a plan in place for remediation.

1. 2020-07-01 Actalis became aware of the OCSP compliance issue through a mailing list post.
2. 2020-07-08 Actalis submitted a preliminary incident report detailing their investigation and planned actions.
3. 2020-08-04 Actalis confirmed the implementation of monitoring controls and plans for certificate revocation.
4. 2020-08-07 The bug was closed, with further discussions consolidated under a related bug for delayed revocation.

1. 2020-07-02 Community commenter — Reported the issue regarding the missing OCSP extension in Actalis' certificates.
2. 2020-07-02 Staff representative — Checked the OCSP responder's certificate and questioned the initial report.
3. 2020-07-08 Staff representative — Provided a preliminary incident report detailing the timeline and actions taken.
4. 2020-08-07 Mozilla representative — Closed the bug and directed further discussion to a related bug on delayed revocation.