Atos incorrect OCSP delegated responder certificates without id-pkix-ocsp-nocheck

Atos reported that it had issued four intermediate CA certificates used for OCSP delegation that included the id-kp-OCSPSigning EKU but did not include the required id-pkix-ocsp-nocheck response. Ryan Sleevi opened the bug after first raising the issue on mozilla.dev.security.policy and provided an example certificate. Atos said it investigated, informed customers, revoked the affected ICAs, and updated its ICA profile to remove the id-kp-OCSPSigning EKU for future issuance. Atos also stated that the private keys for the affected ICAs were destroyed in the presence of its auditor. Mozilla later indicated the bug could be closed, and the bug is resolved fixed.

1. 2019-06-20 An affected ICA certificate was issued with id-kp-OCSPSigning EKU and no id-pkix-ocsp-nocheck.
2. 2019-10-30 An affected ICA certificate was issued with id-kp-OCSPSigning EKU and no id-pkix-ocsp-nocheck.
3. 2020-01-31 An affected ICA certificate was issued with id-kp-OCSPSigning EKU and no id-pkix-ocsp-nocheck.
4. 2020-03-17 An affected ICA certificate was issued with id-kp-OCSPSigning EKU and no id-pkix-ocsp-nocheck.
5. 2020-07-07 Atos revoked two affected ICAs.
6. 2020-07-08 Atos revoked the remaining affected ICAs.
7. 2020-07-14 Atos destroyed the private keys of the affected ICAs in the presence of its auditor.

1. 2020-07-02 Community commenter — Ryan Sleevi reported that Atos had issued OCSP Delegated Responders without the required id-pkix-ocsp-nocheck response and asked for an incident report with a revocation timeline.
2. 2020-07-02 Disabled representative — Atos said it had started investigating the issue and would provide more information.
3. 2020-07-08 Disabled representative — Atos said it had revoked two of four affected ICAs and would revoke the remaining ones that day, with a detailed incident report to follow.
4. 2020-07-10 Disabled representative — Atos provided an incident report describing discovery, timeline, affected certificates, root cause, and remediation steps.
5. 2020-07-13 Mozilla representative — Mozilla asked for an update when key destruction had been completed.
6. 2020-07-15 Disabled representative — Atos confirmed the private keys had been destroyed in the presence of its auditor and that all affected ICAs had been revoked.
7. 2020-07-22 Mozilla representative — Mozilla said the bug could be closed and planned to close it unless further issues were raised.