IdenTrust: OCSP Signer Certificate Missing No-Check Extension

IdenTrust Services, LLC discovered a compliance issue during an internal audit on December 29, 2021, where an OCSP Responder certificate issued for the 'HydrantID Server CA O1' was missing the required 'id-pkix-ocsp-nocheck' extension. Following the discovery, IdenTrust confirmed the mis-issuance, revoked the problematic certificate, and implemented corrective measures, including updating their issuance script and conducting post-issuance quality checks. The issue was resolved by August 31, 2022, with the updated utility ensuring compliance for future certificates. The case was marked as resolved on February 22, 2023.

1. 2021-12-29 Internal audit discovered a missing extension in an OCSP Responder certificate.
2. 2022-01-03 The mis-issued certificate was revoked.
3. 2022-08-31 The issuance utility was updated to prevent future issues.

1. 2022-01-08 IdenTrust Services, LLC — Created a bug report detailing the discovery of the missing extension.
2. 2022-01-17 IdenTrust Services, LLC — Confirmed they are on track with the remediation steps.
3. 2022-03-01 Community commenter — Questioned the transparency of the remediation priorities.
4. 2022-08-31 IdenTrust Services, LLC — Announced the update of the issuance utility to ensure compliance.
5. 2022-09-01 Mozilla representative — Indicated intention to close the case.