IdenTrust: duplicate precertificate flagged by OCSP Watch with invalid status
IdenTrust reported that an IdenTrust-issued certificate was flagged in error by sslmate OCSP Watch with an “unauthorized” status starting March 23, 2023. In its investigation, IdenTrust determined the flagged item was a precertificate pending a retrieval or revocation status update, and that it was a duplicate instance of a certificate that had been properly processed on March 23, 2023, leaving the precertificate with an invalid status. IdenTrust stated this violated CA/B Baseline Requirements section 4.10.2 because the correct OCSP status was not provided within 10 seconds or less for the precertificate. IdenTrust reported that it revoked the problematic certificate instance (Cert-B) on May 9, 2023 and confirmed it was no longer visible in OCSP Watch. IdenTrust also stated it deployed a fix on June 1, 2023 to prevent recurrence and considered the issue resolved, with Mozilla indicating it would close the bug on June 28, 2023 unless questions remained. The bug is marked RESOLVED with resolution FIXED.
- IdenTrust noticed sslmate OCSP Watch flagging an IdenTrust-issued certificate with an “unauthorized” status.
- IdenTrust revoked the problematic certificate instance and confirmed it was no longer visible in OCSP Watch.
- IdenTrust deployed a fix to prevent recurrence of the issue.
- IdenTrust reported no additional updates and considered the issue resolved; Mozilla planned closure.
- IdenTrust Services, LLC — IdenTrust said it noticed on May 1, 2023 that an IdenTrust-issued certificate had been flagged in error by sslmate OCSP Watch since March 23, 2023 and that it would supply an incident report by May 12, 2023.
- IdenTrust Services, LLC — IdenTrust provided a complete incident report describing the issue as a duplicate precertificate left with an invalid status and citing a violation of Baseline Requirements section 4.10.2; it included a timeline and stated it revoked Cert-B on May 9, 2023.
- IdenTrust Services, LLC — IdenTrust stated it was on track to deploy an update to prevent recurrence and would provide a status update on or before June 30, 2023.
- IdenTrust Services, LLC — IdenTrust reported that it deployed a fix on June 1, 2023 to prevent recurrence and considered the issue resolved with no additional updates.
- Mozilla representative — Mozilla stated it would close the bug next week on Wed, 28-June-2023 unless there were any questions or issues still to address.