← Google Trust Services LLC cases
Bugzilla #1882904
Security Incident
Google Trust Services: Incorrect OCSP responses for new ICAs under test
RESOLVED
FIXED
Google Trust Services LLC
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Google Trust Services (GTS) identified an issue with incorrect OCSP responses for new intermediate CAs during testing. The problem was traced to the legacy OCSP responder architecture, which had complexities due to its dual infrastructure. GTS issued an incident report detailing the background, impact, and timeline of the issue, noting that 3,301 OCSP requests received unauthorized responses while 7,922 certificates were issued during the problem period. GTS has since completed a remediation plan to ensure the legacy OCSP pipeline is agnostic to ICA changes and has implemented additional monitoring and validation steps. The incident is now resolved.
Chronology
- GTS investigates OCSP status information issues for new intermediate CAs.
- GTS publishes an incident report detailing the OCSP response issues.
- GTS completes remediation actions related to the OCSP incident.
Thread Activity
- Google representative — GTS is investigating an issue with OCSP status information not being correctly updated on new intermediate CAs.
- Google representative — GTS provides an incident report summarizing the OCSP response issues.
- Google representative — GTS announces the completion of the remediation actions related to the OCSP incident.
Participants
Google representative
Community commenter
Mozilla representative
External References
Similar Local Cases
Entrust: OCSP response signed with SHA-1
IdenTrust: Bad OCSP Responses
DigiCert: OCSP responder returning invalid responses
DigiCert: OCSP not responding issue
HARICA: Anomaly in OCSP services after CA software upgrade
E-Tugra: Incident Report (Security Issues)
DigiCert: Issuance of certs with weak keys (ROCA)
Telia: Disallowed curve (P-521) in leaf certificate