Firmaprofesional: 2022 - CPS missing explanation of OCSP vs CRL delay handling
Firmaprofesional reported a compliance finding identified during its annual eIDAS/ETSI audit. The issue was that its CPS did not correctly explain the difference between OCSP and CRL, specifically how to interpret revocation status when updates between the two methods are delayed and differ. Firmaprofesional stated that its CPS section 4.9.7 and 4.9.10 describe CRL and OCSP update frequencies, and that OCSP responses for TLS certificates have a 24-hour validity interval. It also stated that when a certificate is revoked, OCSP status is updated immediately, with a maximum delay of 30 minutes until an updated CRL is published. To resolve the finding, Firmaprofesional planned to publish a new CPS adding an explanatory paragraph clarifying that during the delay period, the correct certificate status is provided by the OCSP service. The reporter later confirmed that the CPS had been updated and published on June 23, 2022, and considered the issue resolved. The bug was marked RESOLVED with resolution FIXED.
- Firmaprofesional opened a CA Program bug describing an eIDAS/ETSI audit finding about CPS explanation for OCSP vs CRL revocation status delays.
- Firmaprofesional published an updated CPS with an explanatory paragraph addressing the OCSP/CRL delay handling.
- Autoridad de Certificacion Firmaprofesional — Reported that an annual eIDAS/ETSI audit found the CPS lacked correct explanation of how to interpret revocation status when OCSP and CRL updates differ due to delays, and described planned CPS updates.
- Autoridad de Certificacion Firmaprofesional — Confirmed the CPS was updated and published on June 23, 2022, and that the issue was resolved.
- Mozilla representative — Indicated the bug would be closed on or about Wed. 29-June-2022.