D-Trust: OCSP validation service returned "unknown" instead of "good" for 3 OV certificates
D-Trust reported an incident in which its OCSP validation service responded "unknown" instead of "good" for three OV certificates. The affected certificates were issued on January 26, 2024, and the OCSP responses were incorrect for a period of 14 days. D-Trust stated that isolated irregularities in its CA software with reduced availability and individual failures led to an interaction problem between the CA software and the component responsible for publishing certificate status, so the three certificates were produced but not published to the OCSP system. D-Trust also reported that a CA system update preceded the issue and that a patch from the CA system manufacturer was provided and being tested. D-Trust said its monitoring system recorded the error, but the escalation chain did not work for this specific case, so no manual or automated intervention occurred. As remediation, D-Trust added monitoring rules to ensure escalation for this error case and reported that these rules were in place starting 19.02. at 9:00AM. The bug was marked RESOLVED with resolution FIXED, and Mozilla indicated the case was completed and scheduled for closure on 5-Apr-2024.
- D-Trust issued three OV certificates that later experienced incorrect OCSP responses.
- Mozilla received an email report from Ben Wilson about the OCSP "unknown" responses.
- D-Trust reported that the OCSP validation service began responding "good" for the affected OV certificates.
- D-Trust reported monitoring rules were extended to ensure escalation for this error case.
- Mozilla scheduled the case for closure after completion.
- Bdr representative — Opened a preliminary incident report stating that for three OV certificates D-Trust’s OCSP validation service was responding "unknown" instead of "good" and that investigation was underway.
- Bdr representative — Submitted an incident report describing the impact (14 days) and root cause, and listed action items including manual OCSP watch checks and extending monitoring rules for escalation.
- Bdr representative — Provided a quick update that, since 19.02. at 9:00AM, the monitoring rules to ensure escalation were in place.
- Mozilla representative — Noted the case appeared completed and would be scheduled for closure on Friday, 5-Apr-2024.