eMudhra emSign PKI Services: OCSP responder time inconsistency for recently revoked certificates
This case reports an OCSP responder time inconsistency affecting certificates revoked between 12:00 and 23:59 IST. An external researcher alerted emSign CA to a discrepancy in the OCSP response for a recently revoked certificate, where the OCSP and CRL timestamps differed by 12 hours. emSign CA investigated and determined the issue was caused by an incorrect IST-to-UTC time conversion configuration deployed to the OCSP responder, while the CRL timestamps were accurate. The investigation also found that, although OCSP responders updated at the correct frequency, the time conversion issue made the OCSP responses appear inconsistent at appropriate intervals. emSign CA developed a fix, tested it in staging, and deployed the corrected configuration to production, achieving full synchronization between OCSP and CRL; it also implemented enhanced monitoring and additional maker/checker controls. The bug was marked FIXED, and Mozilla indicated it would be closed on 14-Feb-2025 unless there were further issues or questions.
- An external researcher alerted emSign CA to a discrepancy in OCSP responses for a recently revoked certificate.
- emSign CA identified an incorrect IST-to-UTC time conversion configuration in the OCSP responder and raised an incident after confirming the discrepancy.
- A corrected configuration was deployed to production and OCSP/CRL synchronization was achieved with enhanced monitoring and controls.
- Emudhra representative — Filed an incident report describing the OCSP/CRL timestamp discrepancy, its IST-to-UTC configuration root cause, the limited impact, and the remediation steps including staging testing and production deployment.
- Hboeck representative — Provided attachments and stated he was the reporter, sharing OCSP/CRL evidence and the report sent to emSign.
- Emudhra representative — Requested that the Bugzilla be closed unless there were further questions.
- Mozilla representative — Replied with a reference to https://bugzilla.mozilla.org/show_bug.cgi?id=1924492#c2.
- Emudhra representative — Submitted a detailed incident description, root cause(s), remediation description, and commitments, stating all disclosed action items were completed and requesting closure.
- Mozilla representative — Stated Mozilla would close the bug on Friday, 14-Feb-2025, unless there were issues or questions.