Apple CA: Empty SingleExtension in OCSP responses

Apple opened this bug after it identified that its OCSP responders might be impacted by the same issue described in GlobalSign’s report about “Empty SingleExtension in OCSP responses.” Apple stated that on 2020-10-05 it began investigating based on the GlobalSign bug and later confirmed that its EJBCA version exhibited the same non-compliant behavior of including an empty singleExtensions type in OCSP responses. Apple reported that certificate issuance was not affected. Apple contacted PrimeKey, received information about a software fix, and deployed an alpha version of EJBCA 7.4.3 to its UAT environment, verifying the fix with updated OCSP lints and test cases. Apple later reported that it upgraded EJBCA to 7.4.3 in all environments, updated OCSP lints and test cases, and implemented a strict ASN.1 module decoding operation for ASN.1 structures in OCSP responses (with stated exceptions). Apple also verified compliance in production and indicated the open tasks for the incident were completed; Mozilla indicated the bug could be closed.

1. 2020-10-05 Apple began investigating a potential OCSP non-compliance issue after referencing GlobalSign’s report.
2. 2020-10-06 Apple contacted PrimeKey and received information about a software fix for the OCSP issue.
3. 2020-10-07 Apple deployed an alpha version of EJBCA 7.4.3 to UAT and verified the fix with OCSP lints and test cases.
4. 2020-10-31 Apple upgraded EJBCA to 7.4.3 across environments and completed remediation steps including strict ASN.1 decoding and production verification.

1. 2020-10-07 Apple representative — Apple reported it identified potential impact from GlobalSign’s “Empty SingleExtension in OCSP responses” issue and committed to providing a full incident report.
2. 2020-10-14 Apple representative — Apple provided a full incident report describing discovery, investigation steps, and remediation actions, including that certificate issuance was not affected.
3. 2020-10-14 Community commenter — Mozilla community member asked Apple for details about the ASN.1 decoding library used.
4. 2020-10-17 Apple representative — Apple responded that the referenced library is Bouncy Castle.
5. 2020-10-31 Apple representative — Apple stated it upgraded EJBCA to 7.4.3 in all environments, updated OCSP lints and test cases, implemented strict ASN.1 module decoding for OCSP response structures (with exceptions), and verified compliance in production.
6. 2020-12-16 Mozilla representative — Mozilla indicated the bug could be closed and scheduled closure for 2020-12-21 unless issues remained.