Sectigo: Signed OCSP responses not saved for publication due to application restart loop
Sectigo reported an OCSP incident after noticing spikes in its OCSP replication system on June 15, 2026. During investigation, Sectigo identified that its OCSP signing application (CertStatus) k8s pod was restarting every minute, creating a restart loop. Sectigo stated that while replication lag stayed around 5 minutes and the immediate issue was resolved, it later received a support ticket and a CPR reporting “unauthorized” OCSP responses for certificates issued on June 15. Sectigo’s preliminary investigation indicated that OCSP responses were at least partially processed and signed by its HSMs, but some responses never made it to publication. Sectigo said it has a failsafe (continuous refresh signing) that normally signs a new response within a few minutes, but that a backlog in the queue had been growing due to the restart loop, delaying signing and publication. The bug is currently marked ASSIGNED and Sectigo stated it is further investigating the incident.
- Sectigo observed spikes in its OCSP replication system and identified an OCSP signing application restart loop.
- Sectigo received a support ticket and a CPR reporting “unauthorized” OCSP responses for certificates issued on June 15.
- martijn.katerbarg@sectigo.com — Martijn Katerbarg submitted a preliminary incident report describing the CertStatus restart loop, partial signing by HSMs, and OCSP responses not being published, and noted further investigation.