TunTrust: OCSP responder returned "Unknown" for one pre-certificate
The bug was opened after a third party reported an OCSP issue affecting a pre-certificate issued by TunTrust. TunTrust states that on 2026-07-05 it received the report and investigated, confirming the pre-certificate was logged to Certificate Transparency but that the required SCT validation threshold was not met, so the issuance workflow was aborted and the final end-entity certificate was not issued. TunTrust further states that the first pre-certificate was not published and its status in the OCSP responder was "unknown". TunTrust says it generated a second pre-certificate and submitted it to CT logs, but again did not receive enough SCTs; however, unlike the first, this second pre-certificate was properly registered in its OCSP system and returned "good" even though no final certificate was issued. TunTrust also generated a third pre-certificate that received enough SCTs and completed issuance normally, and it says the incident is contained and that the first pre-certificate has now been properly registered in the OCSP responder. TunTrust indicates it is performing root cause analysis and will provide a full incident report within 14 days.
- TunTrust received a third-party report of an OCSP issue for a pre-certificate; issuance was aborted due to insufficient SCTs and the pre-certificate status in OCSP was "unknown".
- TunTrust opened a preliminary incident report bug describing the OCSP status issue and remediation steps.
- Agence Nationale de Certification Electronique — TunTrust submitted a preliminary incident report stating the third-party reported an OCSP issue, describing SCT threshold failures, the resulting "unknown" OCSP status for the first pre-certificate, and that the first pre-certificate was later properly registered in OCSP; TunTrust also said it will provide a full incident report within 14 days.