← Sectigo cases
Bugzilla #1946927
Incident
Certificate Misissuance
Sectigo: Intermittent OCSP unauthorized responses for certificates older than 15 minutes
RESOLVED
FIXED
Sectigo
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Sectigo reported an incident involving intermittent OCSP unauthorized responses for certificates issued more than 15 minutes prior, which violates the TLS Baseline Requirements. The issue was identified on February 8, 2025, when users began experiencing unauthorized responses for several certificates. Sectigo's preliminary investigation indicated a replication delay in their database replicas as the root cause. They implemented changes to their OCSP infrastructure, which resolved the immediate availability issue. A full incident report was provided, detailing the root cause and remediation steps taken, including improvements to documentation and alerting systems. The incident was resolved, and all action items were completed by May 2025.
Chronology
- Sectigo identified intermittent OCSP unauthorized responses for multiple certificates.
- Sectigo completed all action items related to the incident.
Thread Activity
- Community commenter — Reported OCSP unauthorized responses for several Sectigo certificates.
- Sectigo — Acknowledged the report and began investigating the issue.
- Sectigo — Identified the cause as a replication delay in database replicas.
- Sectigo — Provided a report closure summary detailing the incident and remediation.
Participants
Community commenter
Sectigo
External References
Similar Local Cases
Sectigo: Incorrect OCSP responses
Sectigo: Temporary failure to publish OCSP responses for newly issued certificates
Sectigo: Certificate issuance by non-compliant Extant S/MIME CA
Sectigo: OCSP responses directly signed using root certificates without KU=digitalSignature
Sectigo: Certificate issuance delayed for more than 398 days after DCV was completed
Sectigo: SMIME issuance with insufficient validation of mailbox authorization or control
Sectigo: Failure to invalidate Email DCV Random Values after 30 days
Sectigo: Premature disabling of CRL generation for an inactive CA