Certainly: Serving Bad OCSP Responses

Certainly LLC experienced an incident where their OCSP service returned 'unauthorized' responses for valid certificates. The issue was identified on October 24, 2022, during testing of a new monitoring tool. A series of fixes were implemented, restoring correct OCSP responses for approximately 50,000 certificates by October 25. The root cause was a change in serial number prefixes that was not properly configured, leading to unauthorized responses. Remediation steps have been completed, and monitoring continues to ensure no recurrence.

1. 2022-10-24 Incident declared after unauthorized OCSP responses detected.
2. 2022-10-25 Correct OCSP responses restored for all certificates.
3. 2022-11-04 Remediation of the incident completed.