NETLOCK OCSP responder incident; separate 72-hour preliminary-disclosure failure now filed in Bug 2063842
This bug now tracks NETLOCK’s self-disclosed OCSP responder incident only. NETLOCK reported that a publicly trusted TLS certificate it issued for nsi.netlock.hu was not propagated to its OCSP infrastructure, causing the responder to return an "unknown" status until the responder was resynchronised. NETLOCK’s update says the non-compliance began on 2026-06-05, was identified internally on 2026-06-16, and ended on 2026-06-17. The thread also established that the separate Certificate Problem Report response-time issue is being handled in Bug 2052541, and the missed 72-hour preliminary-disclosure deadline has now been filed separately as Bug 2063842. NETLOCK later corrected placeholders in its incident report, including the detection target, BR version, and CP/CPS reference, and said it added detection latency as a contributing factor. The bug remains assigned, and the latest update says the separate preliminary-disclosure report has been filed.
- NETLOCK issued a publicly trusted TLS server certificate for nsi.netlock.hu.
- The issued certificate was not propagated to NETLOCK’s OCSP responder, which began returning an unknown status.
- NETLOCK identified the OCSP responder non-compliance through monitoring-analysis activities.
- The OCSP responder was resynchronised and the non-compliance ended.
- NETLOCK filed a Full Incident Report covering only the OCSP responder issue and said the CPR response-time failure was in Bug 2052541.
- CCADB staff renamed this bug as tracking the OCSP responder incident only.
- NETLOCK said the separate Full Incident Report for the missed 72-hour preliminary-disclosure deadline was filed as Bug 2063842.
- Community commenter — Opened the bug and reported both the OCSP availability failure and the separate failure to acknowledge the CPR within 24 hours.
- Netlock — Said this bug’s Full Incident Report covers only the OCSP responder issue and that the CPR response-time failure is addressed in Bug 2052541.
- Netlock — Clarified that the CPR-response failure is being tracked separately and discussed mailbox handling and Bugzilla awareness.
- Apple representative — Stated that the 24-hour CPR obligation runs from receipt of the CPR and that the late preliminary report was still not accounted for.
- CCADB representative — Renamed the bug to track the OCSP responder incident only and moved the CPR response-time incident to Bug 2052541.
- Netlock — Said NETLOCK still needed to confirm the BR version, CP/CPS reference, placeholder value N, and whether the detection/correction gap should be added to the root cause analysis.
- Netlock — Said NETLOCK was still looking into whether a 72-hour preliminary report was filed and the awareness-to-filing gap, and would respond in the next weekly update.
- CCADB representative — Noted that the report had gone stale and reminded NETLOCK that a Root Store Operator can set a Next update date.
- Netlock — Said the update was being posted in the correct bug, acknowledged the stale report and wrong-bug posting, and requested a Next update date.
- Netlock — Said the separate Full Incident Report for the missed 72-hour preliminary-disclosure deadline was filed as Bug 2063842 and corrected the earlier explanation about the 72-hour control.