eMudhra emSign PKI Services :: OCSP Responder Returned "Unauthorized" for Some Pecertificates
The bug contains a preliminary incident report stating that the emSign CA served RFC 6960 OCSP responses with an "Unauthorized" result for three publicly logged precertificates where the final certificates were not issued. The report says these OCSP responses remained available beyond the 15-minute window required by BR §4.9.9, because OCSP status provisioning for failed issuance transactions used a separate workflow not designed to complete within the required timeframe. The report cites CA/Browser Forum TLS Baseline Requirements §4.9.9 and Mozilla Root Store Policy Section 5.4 regarding providing CRL and OCSP services for certificates presumed to exist based on the presence of a pre-certificate. The incident disclosure is described as originating from an external report received via the CA problem reporting mechanism, followed by internal review by the emSign PKI team. No resolution or next steps are stated in the provided thread content.
- emSign CA OCSP responder returned "Unauthorized" responses for three publicly logged precertificates where final certificates were not issued, and the responses remained available beyond the BR §4.9.9 15-minute window.
- naveen.ml@emudhra.com — Posted a preliminary incident report describing unauthorized OCSP responses for three precertificates, citing BR §4.9.9 and Mozilla Root Store Policy §5.4, and stating the disclosure began from an external problem report followed by internal analysis.