← eMudhra Technologies Limited cases
Bugzilla #1917459
Certificate Problem Report
eMudhra emSign PKI Services : OCSP Responder Time Inconsistency
RESOLVED
FIXED
eMudhra Technologies Limited
AI Summary
An inconsistency was identified in the OCSP responses for recently revoked certificates by eMudhra Technologies Limited. The issue stemmed from a configuration error that caused a 12-hour time difference between OCSP and CRL timestamps for certificates revoked between 12:00 and 23:59 IST. Although the OCSP responders were functioning correctly in terms of updates, the incorrect time conversion led to perceived discrepancies. The incident had minimal impact on customers, as revocation statuses were correctly displayed despite the timestamp issues. A fix was implemented, and enhanced configuration management practices were established to prevent future occurrences.
Chronology
- External researcher reported OCSP response discrepancy.
- Investigation confirmed configuration error affecting time conversion.
- Corrected configuration deployed to production.
- Audit of configuration management process completed.
- Enhanced testing for OCSP/CRL behavior finalized.
Participants
Naveen Kumar ML
Hanno Böck
B. Wilson
External References
Similar Local Cases
eMudhra: Invalid CRL signatures
eMudhra emSign PKI Services : Issue with revocation as part of automated reissuance
eMudhra emSign PKI Services: CA Certificates not published in DER Encoded Format
eMudhra emSign PKI Services : Key Blocking Mechanism Fails to Validate Historical Public Key Reuse.
eMudhra emSign PKI Services: Policy Document Inconsistency
eMudhra: Failure to respond to a Problem Report within 24 hours
eMudhra: Delayed Publication of Issuing CA Certificates In CCADB
eMudhra: CRL occasionally unavailable and returns 404 error