TunTrust third-party reported OCSP publication failure for one aborted precertificate; bug resolved fixed
This case concerns a third-party report that TunTrust’s OCSP responder returned "OCSP responder does not know this certificate" for one aborted OV SSL precertificate. TunTrust investigated and confirmed that the precertificate had been submitted to CT, but the SCT threshold was not met, so issuance was aborted and no end-entity certificate was issued. The problem in this case was that the aborted precertificate was not registered in OCSP, causing an "unknown" response; TunTrust later published the affected precertificate to OCSP and restored an authoritative response. TunTrust said a second aborted precertificate was registered correctly and returned "good," and a third precertificate later issued normally. In its closure summary, TunTrust said the incident was contained, no additional precertificates were affected, and no subscribers or end-entity certificates were impacted. The report was marked stale by CCADB, TunTrust filed a closure summary, CCADB issued a final call for comments, and the bug is now RESOLVED FIXED.
- The OCSP publication failure period began for one aborted precertificate.
- A third party reported that TunTrust’s OCSP responder did not know one precertificate.
- The affected precertificate was published to OCSP and the unknown status was restored to an authoritative response.
- TunTrust filed its full incident report describing the OCSP registration failure and remediation.
- TunTrust filed a closure summary stating the incident was contained and no additional precertificates were affected.
- Agence Nationale de Certification Electronique — TunTrust filed a preliminary incident report saying the first precertificate was not registered in OCSP, that the issue was contained, and that a full incident report would follow within 14 days.
- Agence Nationale de Certification Electronique — TunTrust filed the full incident report, stating the OCSP failure affected one aborted precertificate, was linked to a recent application upgrade, and did not impact end-entity certificates or subscribers.
- Agence Nationale de Certification Electronique — TunTrust updated the final action item to Complete and repeated the full incident report details.
- CCADB representative — CCADB said the report had gone stale and asked TunTrust to file a Closure Report if it was ready for closure.
- Agence Nationale de Certification Electronique — TunTrust filed a Report Closure Summary describing the root cause, remediation, and commitments.
- CCADB representative — CCADB issued a final call for comments or questions and said the report would be closed around 2026-08-18.