Microsoft PKI Services: "unknown" OCSP response for issued certificates

Microsoft PKI Services reported an issue where their OCSP responder was returning an "unknown" status for several issued certificates. The problem was discovered internally when the bug was assigned on October 3, 2022. An initial investigation revealed that OCSP publishing issues had occurred, affecting all reported certificates. Microsoft took immediate action by manually publishing the affected certificates to OCSP and implemented new monitoring processes to prevent future occurrences. A comprehensive review identified a total of 2221 certificates that had not been published to OCSP, all of which have since been addressed. The CA is continuing to investigate and improve their processes to ensure compliance with Mozilla's policies.

1. 2022-10-03 Microsoft PKI Services became aware of OCSP publishing issues affecting issued certificates.
2. 2022-10-12 Microsoft PKI Services completed an exhaustive review of all CAs and identified the root cause of the OCSP publishing failures.
3. 2022-10-25 Clarification provided that pre-certificates issued before October 1, 2022, are not subject to the OCSP requirements.

1. 2022-10-03 Mm representative — Created attachment detailing OCSP responses with status 'unknown' for several certificates.
2. 2022-10-04 Disabled representative — Acknowledged the issue and promised a preliminary report.
3. 2022-10-12 Disabled representative — Provided a detailed incident report and timeline of actions taken.
4. 2022-10-25 Mozilla representative — Clarified that the OCSP requirements do not apply retroactively to pre-certificates issued before the effective date.