← SSL.com cases
Bugzilla #1931636
Incident
SSL.com: Delay in publishing OCSP responses
RESOLVED
FIXED
SSL.com
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
On November 13, 2024, SSL.com reported a potential issue with OCSP responses for certificates issued from two subCAs, which were found to be misconfigured and not serving pre-signed OCSP responses. This incident was treated as a compliance failure, prompting SSL.com to initiate an internal investigation and the Certificate Problem Report (CPR) process. The misconfiguration was corrected the same day, and the issue was found to affect four subCAs from November 7 to November 13, 2024. SSL.com has since completed several remediation actions, including improvements to their post-ceremony processes and automated OCSP monitoring. A final incident report was submitted on February 7, 2025, confirming that all action items have been completed.
Chronology
- SSL.com received a report of OCSP response issues affecting two subCAs.
- SSL.com posted a Preliminary Incident Report to Bugzilla.
- SSL.com submitted a final incident report confirming completion of all action items.
Thread Activity
- SSL.com — Posted a Preliminary Incident Report detailing the OCSP response issue.
- SSL.com — Submitted a Final Incident Report outlining the incident and remediation actions.
- SSL.com — Provided an Incident Report Closure Summary confirming all action items were completed.
Participants
SSL.com
Mm representative
Mozilla representative
External References
Similar Local Cases
SSL.com: CAA Empty set handling results in Wildcard issuance
SSL.com: Failure to process CAA records from one SubCA
SSL.com: Issuance of certificates using keys previously reported as compromised
SSL.com: Issuance of 3 EV TLS certificates without 2-person validation of the organization information
SSL.com: Issuance of TLS certificates with domain validation methods prohibited by SC-45
SSL.com: Precertificates without corresponding certificates return OCSP value of "Unknown"
GlobalSign: RSA-1024 leaf certificate issued after 2013-12-31
IdenTrust: Unauthorized OCSP response on a Timestamp certificate