DigiCert: OCSP responder not updating issue (auditor-discovered)
DigiCert reported that during an audit of its production systems in Europe, auditors (BDO) found that the OCSP responder was not updating as expected, with the last update on 13 January 2023. DigiCert stated that the issue affected OCSP responses only and that there were no impacted certificates. DigiCert said the problem was caused by a failure of an API: after DigiCert updated to 64-bit, the configured API key kept failing the permission check, and the failed API was used to transfer OCSP responses from origin servers to the European system. DigiCert deployed related web server changes in Europe on 13 January 2023, then on 9 February 2023 the auditor notified DigiCert Compliance, DigiCert reviewed and investigated, confirmed and escalated to Engineering, and resolved and tested the issue. DigiCert restored service by generating and installing a new API key, and it added monitoring/alerts for the European OCSP responder plus additional alert-auditing steps and checklist requirements for future releases. The bug was requested to be closed after no further updates were needed, and Mozilla indicated it would close it on or about 8 March 2023; the bug resolution is FIXED.
- DigiCert production team deployed web server changes related to OCSP operation in its European data centre.
- DigiCert confirmed and resolved the OCSP responder update issue after auditor notification and engineering escalation.
- DigiCert added monitoring to the new European systems for the OCSP responder.
- DigiCert — Reported that BDO auditors found the OCSP responder was not updating (last update 13-Jan-2023), described the API/64-bit permission-check failure cause, and outlined remediation steps including a new API key and added monitoring/alert coverage.
- DigiCert — Asked if there were any questions and requested closing the bug if none.
- Community commenter — Agreed that Ben could close the bug since there were no questions.
- Community commenter — Asked Ben if anything else was needed from DigiCert.
- Mozilla representative — Indicated Mozilla would close the bug on or about Wed, 8-March-2023.