CFCA: OCSP responders returning “unauthorized” errors for three intermediate CA certificates
The bug reports that CFCA’s OCSP responders for three intermediate CA certificates issued under CFCA_Global_RSA_ROOT_G2—CFCA_DV_RSA_OCA_G2, CFCA_OV_RSA_OCA_G2, and CFCA_EV_RSA_OCA_G2—are returning “unauthorized” errors. The reporter states the root cause is that the OCSP responder signing certificates have not yet been issued by the offline Root CA, and that the OCSP system database has not been configured with the corresponding intermediate CA certificate data. The reporter also states that no subscriber certificates have been issued from this hierarchy. The report cites CA/Browser Forum Baseline Requirements Section 4.9.9 regarding OCSP status communication for certificates with an id-ad-ocsp AIA accessMethod. The bug thread indicates the incident disclosure source is a third-party report.
- A third-party reported that CFCA OCSP responders for three intermediate CA certificates are returning “unauthorized” errors.
- songxinlei@gmail.com — Reported reproduction steps and described an OCSP “unauthorized” error affecting CFCA_DV_RSA_OCA_G2, CFCA_OV_RSA_OCA_G2, and CFCA_EV_RSA_OCA_G2, attributing it to missing OCSP responder signing certificates and missing OCSP database configuration for the intermediate CA data.