QuoVadis: revocation services validity set to expected value plus one second

The bug describes a timing issue affecting QuoVadis revocation services (OCSP and CRL) where the validity period was effectively set to the expected value plus one second. The CA said it became aware of the problem by following a bug posted by GTS (Bug 1731164) and that, on 9/24, GTS informed it that QuoVadis OCSP services were off by one second due to inclusive start time handling. The CA stated that QuoVadis OCSP responses are good for 48 hours, which is shorter than the requirement in Baseline Requirements section 4.9.10, and that because time is inclusive, OCSP responses set to 48 hours were actually valid for 48 hours and 1 second; the same was said to apply to CRL validity periods being 1 second longer than defined in the CPS. In response, the CA said it stopped issuing CRL and OCSP responses outside the timeline specified in the QuoVadis CPS and updated the QuoVadis CPS to accurately describe revocation services timing, with CPS approval and publication on 9/24. The CA also reported contacting PrimeKey to update EJBCA to account for the 1-second issue and referenced a planned EJBCA update (EJBCA 7.8.0.1) when available. The bug was resolved as FIXED.

1. 2021-09-23 GTS notified the CA that QuoVadis OCSP responses were off by one second due to inclusive start time handling.
2. 2021-09-24 The CA updated and published the QuoVadis CPS to correct revocation services timing terminology.
3. 2021-10-07 The CA stated the correction was to amend the CPS and noted planned EJBCA fixes via PrimeKey.
4. 2021-10-13 Mozilla planned to close the matter on or about this date unless there were objections.

1. 2021-09-28 DigiCert — Explained how GTS informed the CA of the one-second OCSP timing issue, described the inclusive-time effect on OCSP/CRL validity versus CPS/BR terminology, and stated actions taken including stopping out-of-timeline issuance and updating the QuoVadis CPS.
2. 2021-09-28 DigiCert — Added an attachment listing issuing CAs affected by the “plus second” on revocation services.
3. 2021-10-07 DigiCert — Clarified that the correction was to amend CPS terminology, stated CRL/OCSP settings were within maximum validity periods in BR requirements, and referenced the PrimeKey EJBCA fix.
4. 2021-10-07 Mozilla representative — Indicated intent to close the matter on or about 13-Oct-2021 unless there were objections.