NETLOCK failed to file a preliminary incident report within 72 hours for an OCSP responder incident
This case concerns NETLOCK’s failure to file a preliminary incident report within 72 hours after becoming aware of a compliance incident involving an OCSP responder returning "unknown" for a validly issued certificate. NETLOCK says it learned of the issue through its own monitoring on 2026-06-16, and that a preliminary report was due by 2026-06-19. The bug states that no public report was filed by that deadline, and the first public disclosure did not occur until 2026-07-03 in Bug 2051459. The thread explicitly separates this disclosure-timeliness failure from the underlying OCSP incident and from the separate CPR-related failure to acknowledge a Certificate Problem Report within 24 hours in Bug 2052541. NETLOCK says the underlying OCSP condition was remediated on 2026-06-17, but the disclosure obligation was still missed. The case remains UNCONFIRMED in the thread provided.
- NETLOCK became aware of an OCSP responder compliance incident through its own monitoring.
- The 72-hour preliminary incident report deadline passed without a public report.
- NETLOCK first publicly disclosed the incident in Bug 2051459.
- Netlock — Opened the bug as a full incident report and stated that NETLOCK missed the 72-hour preliminary incident reporting deadline.
- Netlock — Explained that the underlying OCSP incident is tracked in Bug 2051459 and the separate 24-hour CPR response failure is tracked in Bug 2052541.