QuoVadis / PKIoverheid: incorrect OCSP response for precertificate

Logius detected unusual OCSP responses for some precertificates issued by QuoVadis, prompting an investigation that revealed a compliance issue with the EJBCA CA software. QuoVadis confirmed that certain precertificates were incorrectly returning a revoked/certificateHold status, which is prohibited under the Baseline Requirements. Following the identification of the issue, QuoVadis worked with PrimeKey to address the root cause and updated their OCSP responses to comply with requirements. The issue has been resolved, and affected precertificates have been restored in the CA database, responding correctly in OCSP. Ongoing monitoring for potential reoccurrences is in place.

1. 2021-07-22 Logius contacted QuoVadis regarding OCSP responses for precertificates.
2. 2021-08-30 Monitoring for reoccurrences of the EJBCA issue confirmed no further incidents.
3. 2021-10-18 Required updates were made, and no further steps are needed.

1. 2021-08-05 Logius representative — Logius detected unusual OCSP responses for some pre-certificates issued by QuoVadis.
2. 2021-08-06 DigiCert — QuoVadis confirmed the issue and began investigating the root cause.
3. 2021-08-13 DigiCert — QuoVadis identified 54 affected precertificates and restored them in the CA database.
4. 2021-10-18 DigiCert — The required updates have been made; there are no further steps to report.