IdenTrust: OCSP response validity for subordinate CA OCSP responders exceeded CPS language
IdenTrust reported that, during an internal review, it discovered a compliance discrepancy in the validity period language for OCSP responses for 14 subordinate CA(s) under the IdenTrust TrustID CPS. The TrustID CPS section 4.9.10 states that OCSP responses for subordinate CA certificates last for 24 hours, but the OCSP responses in question had a validity period of less than 7 days and were 1 second greater than specified in the CPS language. IdenTrust stated that certificate issuance was not involved, but that OCSP responses exceeding one second were out of CPS compliance until the CPS language was updated. IdenTrust investigated after receiving an internal message identifying the discrepancy, confirmed it affected multiple subordinate CA OCSP responders, and determined the best fix was to update the TrustID CPS language to match the validity period already being delivered. IdenTrust initiated the CPS update process, published the updated TrustID CPS on 2022-05-27, and updated section 4.9.10 to describe OCSP update timing (at least every twelve months and within 24 hours after revoking a subordinate CA certificate). In a later comment, IdenTrust confirmed that once the CPS was updated and published on May 27, 2022, it considered the issue resolved. The bug was marked RESOLVED with resolution FIXED.
- IdenTrust received an internal message identifying a discrepancy in TrustID CPS OCSP response validity period language.
- IdenTrust confirmed the discrepancy affected multiple subordinate CA OCSP responders and that OCSP validity was 1 second greater than specified in its CPS.
- IdenTrust initiated the TrustID CPS update process to correct the CPS language.
- IdenTrust published the updated IdenTrust TrustID CPS with revised section 4.9.10 language.
- Mozilla marked the bug as RESOLVED with resolution FIXED.
- IdenTrust Services, LLC — IdenTrust disclosed that internal review found OCSP response validity for 14 subordinate CA(s) did not conform to TrustID CPS section 4.9.10, and described its investigation and CPS update actions.
- IdenTrust Services, LLC — IdenTrust confirmed that after the CPS update and publication on May 27, 2022, it considered the issue resolved.
- Mozilla representative — Mozilla stated it would close the bug on Wed 22-June-2022 unless further issues were raised.