KIR incident report closed after fixing OCSP coverage and CPR triage for a precertificate-only issuance
Krajowa Izba Rozliczeniowa S.A. (KIR) is the subject of a third-party Certificate Problem Report about an OCSP responder returning `unknown` for one precertificate. KIR explained that the precertificate was signed and logged to CT, but no final certificate was issued, so its OCSP process had no entry for that serial. The thread also records that KIR’s acknowledgement to the reporter took more than 24 hours, and KIR accepted that this response time was non-conformant. KIR said it maintains a continuous 24x7 channel to accept CPRs, but its intake and triage initially checked only final certificates, which delayed recognition of the report as a valid CPR. KIR later completed the CPR intake/triage update, published the affected serial to OCSP with authoritative `good` status, and stated that all action items were complete. On 2026-07-27, KIR posted a closure summary requesting closure of the incident report, and CCADB issued a final call for comments with a planned closure date of about 2026-08-03.
- A precertificate was signed without a corresponding final certificate being issued.
- KIR received a CPR email reporting that its OCSP responder returned `unknown` for the precertificate.
- KIR replied to the reporter after more than 24 hours.
- KIR published the precertificate serial to OCSP with authoritative `good` status.
- KIR stated that all action items were completed and requested closure of the incident report.
- Kir representative — Opened a preliminary incident report saying KIR received a problem report about an OCSP response of `unknown` for one precertificate and had started analysis.
- Kir representative — Filed the full incident report explaining that the precertificate had no final certificate and that OCSP status was created only at final issuance.
- Community commenter — Asked KIR to explain the delay beyond 24 hours and whether it maintained the required continuous 24x7 ability to accept and respond to CPRs.
- Kir representative — Accepted that the response exceeded 24 hours and said the report was not initially recognized as a valid CPR because it did not match final-certificate inventory.
- Kir representative — Posted a weekly update saying there were no changes and activities were progressing as planned.
- Kir representative — Reported completion of the CPR intake/triage update so serials not found among final certificates are also checked against precertificates and all reports are acknowledged within 24 hours.
- Kir representative — Stated that all key activities were on track and progressing as planned.
- Kir representative — Posted a weekly update repeating that all key activities were on track and progressing as planned.
- Kir representative — Posted a closure summary stating that all action items were completed and requesting closure of the incident report.
- CCADB representative — Issued a final call for comments or questions and said the report would be closed on approximately 2026-08-03.