TunTrust: third-party reported OCSP publication failure for one aborted precertificate; closure pending
This case concerns a third-party report that TunTrust’s OCSP responder returned "unknown" for one aborted OV SSL precertificate. TunTrust investigated and confirmed that the precertificate had been submitted to CT, but only one SCT was returned, so issuance was aborted and no end-entity certificate was issued. The bug is about the precertificate not being registered in OCSP after that aborted issuance, which caused the unknown response. TunTrust later generated a second aborted precertificate that was registered in OCSP and returned "good," and then a third precertificate that received enough SCTs and issued normally. In its closure summary, TunTrust said the affected precertificate was published to OCSP on 2026-07-06, that no additional precertificates were affected, and that the incident was contained. CCADB marked the report stale on 2026-08-10, TunTrust filed a closure summary on 2026-08-11, and CCADB issued a final call for comments with expected closure around 2026-08-18.
- The OCSP publication failure period began for one aborted precertificate.
- A third party reported that TunTrust’s OCSP responder did not know one precertificate.
- The affected precertificate was published to OCSP and the unknown status was restored to an authoritative response.
- TunTrust filed its full incident report describing the OCSP registration failure and remediation.
- TunTrust filed a closure summary stating the incident was contained and no additional precertificates were affected.
- Agence Nationale de Certification Electronique — TunTrust filed a preliminary incident report saying the first precertificate was not registered in OCSP, that the issue was contained, and that a full incident report would follow within 14 days.
- Agence Nationale de Certification Electronique — TunTrust filed the full incident report, stating the OCSP failure affected one aborted precertificate, was linked to a recent application upgrade, and did not impact end-entity certificates or subscribers.
- Agence Nationale de Certification Electronique — TunTrust updated the final action item to Complete and repeated the full incident report details.
- CCADB representative — CCADB said the report had gone stale and asked TunTrust to file a Closure Report if it was ready for closure.
- Agence Nationale de Certification Electronique — TunTrust filed a Report Closure Summary describing the root cause, remediation, and commitments.
- CCADB representative — CCADB issued a final call for comments or questions and said the report would be closed around 2026-08-18.