← China Financial Certification Authority (CFCA) cases
Bugzilla #1778035
Self Incident Disclosure
CFCA: The wrong status of OCSP
RESOLVED
FIXED
China Financial Certification Authority (CFCA)
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
The China Financial Certification Authority (CFCA) discovered an issue with the Online Certificate Status Protocol (OCSP) while addressing a separate incident. They identified that some cache data was not synchronized following an OCSP system update in May, which affected the status of approximately 14 certificates. CFCA took corrective actions by updating their systems on June 15 and 16, resolving the issue. They have since implemented measures to enhance their testing methods and are developing pre-issuance and post-issuance lints to prevent future occurrences. The issue was reported and fixed, and CFCA has committed to ongoing improvements in their certificate management processes.
Chronology
- CFCA updated their test and production systems to fix the OCSP issue.
Thread Activity
- China Financial Certification Authority (CFCA) — CFCA reported an OCSP problem discovered during another incident investigation.
- China Financial Certification Authority (CFCA) — CFCA completed the application of ZLint service to ensure certificates pass verification before issuance.
- Mozilla representative — Mozilla scheduled to close the case on or about April 19, 2023.
Participants
China Financial Certification Authority (CFCA)
Mozilla representative
Google representative
External References
Related Bugzilla IDs Mentioned
Similar Local Cases
CFCA: Delayed reporting of intermediate CA certificate
CFCA: certificate basicConstraints extension not marked as critical
CFCA: Precertificate with postalCode and streetAddress swapped
CFCA: Wrong SerialNumber encoding
CFCA: BasicConstraints are not marked as critical certificates are missing and therefore not revoked
CFCA: Failure to respond to a CPR in a complete and/or timely manner
CFCA: Failed to follow Report lifecycle rule to respond within 7 days
CFCA: ICA without EKU