IdenTrust: Invalid OCSP Response Held in Cache

IdenTrust experienced an issue where an invalid OCSP response was held in cache after deploying a new OCSP signing certificate. This led to validation errors for some relying parties of Let's Encrypt subordinate CAs cross-signed by DST Root CA X3. The problem was identified on October 16, 2020, when connectivity alerts were triggered due to excessive traffic overload, resulting in a temporary outage. The cache issue persisted until the old responses expired, which could have affected clients during that time. IdenTrust has since implemented remediation steps to prevent recurrence.

1. 2020-10-16 New OCSP response signed, old response cached
2. 2020-10-19 Delegated OCSP signing certificate expired
3. 2020-10-16 Connectivity alert issued