IdenTrust: Unauthorized OCSP responses for cross-signed roots

IdenTrust Services, LLC self-disclosed an incident involving unauthorized OCSP responses for four cross-signed certificates. The issue was identified during routine monitoring, revealing that the corresponding Intermediate Certificate Authorities (ICAs) were not included in the OCSP configuration prior to the certificates' disclosure to the Common CA Database (CCADB). A full incident report was submitted, detailing the timeline of events and root causes, including configuration gaps and process oversights. The CA has completed all action items to remediate the issue and has requested closure of the incident report.

1. 2026-01-26 Non-compliance start date identified
2. 2026-02-02 Non-compliance identified
3. 2026-02-05 Preliminary incident disclosed
4. 2026-02-17 Full incident report submitted
5. 2026-04-23 Incident report closure requested

1. 2026-02-04 IdenTrust Services, LLC — Preliminary incident report submitted detailing unauthorized OCSP responses.
2. 2026-02-05 Community commenter — Questioned the self-disclosure claim due to reliance on a third-party tool.
3. 2026-02-18 IdenTrust Services, LLC — Full incident report provided with detailed analysis and action items.
4. 2026-03-10 IdenTrust Services, LLC — Requested closure of the incident report.
5. 2026-04-16 CCADB representative — Final call for comments before closure of the incident report.