Microsoft PKI Services OCSP non-compliance incident closed after all action items were completed
Microsoft PKI Services disclosed a self-reported compliance incident involving its OCSP responder infrastructure during a migration to new systems. The issue was that OCSP responses from the new infrastructure included fractional seconds in the thisUpdate, nextUpdate, revocationTime, and producedAt fields, which caused TLS handshakes to fail for some relying parties and was inconsistent with RFC 5280. Microsoft said it moved OCSP traffic back to its legacy infrastructure after discovering the problem, then worked through repair items to address the testing gap and complete the migration. In its closure summary, Microsoft said it updated the OCSP responder implementation to generate RFC 5280-compliant GeneralizedTime values without fractional seconds and expanded validation testing. Microsoft later stated that all action items were completed and requested closure, and CCADB issued a final call for comments before closing the report around 2026-07-01.
- Migration to new OCSP infrastructure started.
- OCSP responses with fractional seconds caused TLS handshake failures for some relying parties.
- OCSP traffic was moved back to the legacy responder infrastructure.
- Microsoft said all action items were completed and submitted a closure summary.
- CCADB indicated the incident report would be closed around this date.
- Microsoft Corporation — Microsoft filed a preliminary incident report describing the OCSP formatting issue and the fallback to legacy infrastructure.
- Microsoft Corporation — Microsoft filed the full incident report with the timeline, root cause analysis, and planned migration-back date.
- Microsoft Corporation — Microsoft extended the due date for action item #3 and said it would implement both an internal OCSP solution and a backup external implementation.
- Microsoft Corporation — Microsoft said all action items were completed and submitted a report closure summary.
- CCADB representative — CCADB issued a final call for comments or questions and said the incident report would be closed on approximately 2026-07-01.