← IdenTrust Services, LLC cases
Bugzilla #1749089
Certificate Problem Report
IdenTrust: OCSP Signer Certificate Missing No-Check Extension
RESOLVED
FIXED
IdenTrust Services, LLC
AI Summary
IdenTrust Services, LLC identified a mis-issuance of an OCSP Responder certificate that lacked the required 'id-pkix-ocsp-nocheck' extension. This issue was discovered during an internal audit on December 29, 2021, leading to immediate corrective actions, including revocation of the mis-issued certificate and updates to their issuance processes. The CA has committed to implementing a linting tool to prevent similar issues in the future, with updates provided regularly on their progress. The case has been resolved with the necessary changes made to their certificate issuance utility.
Chronology
- Internal review discovered a potential mis-issuance.
- Revoked the mis-issued certificate.
- Updated issuance utility to include required extension.
Participants
IdenTrust
Ben Wilson
Ryan Sleevi
External References
Similar Local Cases
IdenTrust: OCSP Responder missing id-pkix-ocsp-nocheck
IdenTrust: Incorrect Subject Details for HydrantId
IdenTrust: Invalid OrganizationIdentifier in S/MIME certificates
IdenTrust: Incorrect response for OCSP validation
IdenTrust: Service Degradation
IdenTrust: Failure to provide OCSP responses for valid ICA certificates
IdenTrust: EV TLS certificate with wrong jurisdiction state for private organization
IdenTrust: Missing Revocation Reasons in CRL