NETLOCK OCSP responder incident with separate CPR response-time and disclosure-process issues tracked in related bugs
This bug now tracks NETLOCK’s self-disclosed OCSP responder incident, not the separate CPR response-time failure. NETLOCK reported that a publicly trusted TLS certificate for nsi.netlock.hu was issued on 2026-06-05 but was not propagated to its OCSP responder infrastructure, causing the responder to return "unknown" until the responder was resynchronised on 2026-06-17. NETLOCK said it identified the non-compliance internally on 2026-06-16 through monitoring-analysis activities. The thread also records that the CPR response-time failure is being handled in Bug 2052541, and that the missed 72-hour preliminary disclosure was later filed as Bug 2063842. NETLOCK corrected earlier placeholders in its incident report, including the BR version, CP/CPS reference, and detection target, and added detection latency as a contributing factor. On 2026-08-15, NETLOCK confirmed that the separate Full Incident Report for the missed 72-hour preliminary-disclosure deadline had been filed as Bug 2063842. On 2026-10-01, NETLOCK said the Full Incident Report for the cadence failure was filed as Bug 2052541 Comment #15, and it also noted that a self-detected CRL publication defect found on 2026-09-26 may be covered by Bug 2075720 or may have needed its own report. The bug remains open and was last updated on 2026-10-01.
- NETLOCK issued a publicly trusted TLS server certificate for nsi.netlock.hu.
- The issued certificate was not propagated to NETLOCK’s OCSP responder, which began returning an unknown status.
- NETLOCK identified the OCSP responder non-compliance through monitoring-analysis activities.
- The OCSP responder was resynchronised and the non-compliance ended.
- NETLOCK filed a Full Incident Report covering only the OCSP responder issue and said the CPR response-time failure was in Bug 2052541.
- CCADB staff renamed this bug as tracking the OCSP responder incident only and moved the CPR response-time incident to Bug 2052541.
- NETLOCK said the separate Full Incident Report for the missed 72-hour preliminary-disclosure deadline was filed as Bug 2063842.
- NETLOCK found a CRL publication defect while verifying the Gold hierarchy.
- Community commenter — Opened the bug and reported both the OCSP availability failure and the separate failure to acknowledge the CPR within 24 hours.
- Netlock — Said this bug’s Full Incident Report covers only the OCSP responder issue and that the CPR response-time failure is addressed in Bug 2052541.
- Netlock — Clarified that the CPR-response failure is being tracked separately and discussed mailbox handling and Bugzilla awareness.
- Apple representative — Stated that the 24-hour CPR obligation runs from receipt of the CPR and that the late preliminary report was still not accounted for.
- CCADB representative — Renamed the bug to track the OCSP responder incident only and moved the CPR response-time incident to Bug 2052541.
- Netlock — Said NETLOCK still needed to confirm the BR version, CP/CPS reference, placeholder value N, and whether the detection/correction gap should be added to the root cause analysis.
- Netlock — Said NETLOCK was still looking into whether a 72-hour preliminary report was filed and the awareness-to-filing gap, and would respond in the next weekly update.
- CCADB representative — Noted that the report had gone stale and reminded NETLOCK that a Root Store Operator can set a Next update date.
- Netlock — Acknowledged that the report went stale and that the update was first posted to the wrong bug before being corrected.
- Netlock — Confirmed that Bug 2063842 was filed for the missed 72-hour preliminary-disclosure deadline and corrected the earlier explanation about the 72-hour control.
- Community commenter — Said the report appears to have gone stale because no extended update deadlines were applied for.
- Netlock — Said the report had gone stale, that weekly updates stopped after 2026-08-15, and that a separate incident report for the cadence failure would be filed by 2026-09-30.
- Netlock — Said the cadence-failure report was filed in Bug 2052541 Comment #15 and reported that a self-detected CRL publication defect may be covered by Bug 2075720 or may have needed its own report.