QuoVadis / PKIoverheid: incorrect OCSP response for precertificate

This case addresses an issue with QuoVadis where incorrect OCSP responses were returned for certain precertificates. The problem was identified by Logius, the Policy Authority of PKIoverheid, during a routine check, leading to an investigation that uncovered discrepancies in OCSP behavior. QuoVadis worked with PrimeKey to resolve the issue, which involved a rollback in the CA database affecting the OCSP responses. A total of 54 affected precertificates were identified and subsequently restored to compliant OCSP responses. The issue has been resolved with updates to the EJBCA software.

1. 2021-07-22 Logius contacted QuoVadis regarding OCSP responses.
2. 2021-08-05 Incident report updated with input from Logius.
3. 2021-10-18 Required updates made; no further steps to report.