← Izenpe S.A. cases
Bugzilla #1996857
Self Reported Incident
Certificate Misissuance
IZENPE: not allowed Key Usage in ocsp responder certificate
RESOLVED
FIXED
Izenpe S.A.
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Izenpe S.A. self-reported a compliance issue regarding their OCSP responder certificates, which included the 'nonRepudiation' key usage extension, contrary to the Baseline Requirements that only permit 'digitalSignature'. This non-compliance was identified on October 28, 2025, during a review prompted by a previous bug. The CA issued new OCSP responder certificates that comply with the updated requirements, and they began signing OCSP responses on November 24, 2025. Izenpe has committed to continuous monitoring of their compliance with the Baseline Requirements to prevent future issues.
Chronology
- BR 2.0.0 changes regarding OCSP responder key usage came into effect.
- Non-compliance with OCSP responder certificates was identified.
- New compliant OCSP responder certificates were issued.
- New OCSP responder certificates began signing OCSP responses.
Thread Activity
- Izenpe S.A. — Izenpe discovered that their OCSP responder certificates did not comply with the BRs.
- Izenpe S.A. — New OCSP responder certificates have been issued and will start signing OCSP requests.
- Izenpe S.A. — The new OCSP responder certificates have started signing OCSP responses.
- CCADB representative — Final call for comments on the incident report before closure.
Participants
Izenpe S.A.
Snowflake representative
CCADB representative
External References
Related Bugzilla IDs Mentioned
Similar Local Cases
Izenpe: Not allowed Qualifier ID OID on Certificate Policies extension
Izenpe: Duplicate attribute in Subject
IZENPE: IssuingDistributionPoint extension in CRLs not marked as Critical
Izenpe: Incorrect Unicode characters in Subject
IZENPE: Outdated CPS for Izenpe Root
Lawtrust: The S/MIME CA’s policy identifiers did not align with the CA/Browser Forum Requirements.
Izenpe: Non-BR-Compliant Certificate Issuance
Izenpe: incorrect value in stateOrProvinceName