Firmaprofesional incident: OCSP responder authorization and signature verification errors for Secure Web 2024

Firmaprofesional opened this bug to report an incident affecting OCSP responses for certificates issued by AC Firmaprofesional - Secure Web 2024. The issue was first reported externally on 2026-09-11 after OCSP Watch showed signature verification errors for 42 affected issuance entries. Firmaprofesional said its issuer-specific OCSP responder had been disabled after the CA was revoked, and requests were then answered by the root CA’s default delegated responder, which was not authorized for that subordinate CA’s certificates. The company re-enabled the Secure Web 2024 OCSP responder across four documented nodes on 2026-09-14, after which the reported errors were no longer observed. Firmaprofesional later completed monitoring and change-management action items, and on 2026-10-19 requested closure of the bug.

1. 2026-01-23 The Secure Web 2024 CA certificate was revoked and its issuer-specific OCSP binding was disabled.
2. 2026-09-11 An external notification reported OCSP signature verification errors for Secure Web 2024 certificates.
3. 2026-09-14 Firmaprofesional re-enabled the Secure Web 2024 OCSP responder across the documented nodes.
4. 2026-10-09 Firmaprofesional completed the OCSP monitoring action item.
5. 2026-10-16 Firmaprofesional completed the remaining CA retirement and OCSP change-management action item.
6. 2026-10-19 Firmaprofesional requested closure after stating all disclosed action items were complete.

1. 2026-09-14 Autoridad de Certificacion Firmaprofesional — Filed a preliminary incident report describing third-party reported OCSP signature verification errors and said the delayed response would be documented separately.
2. 2026-09-21 Autoridad de Certificacion Firmaprofesional — Reported that OCSP Watch showed no recurrence and said the Full Incident Report would be published by 2026-09-28.
3. 2026-09-28 Autoridad de Certificacion Firmaprofesional — Posted the Full Incident Report with the incident timeline, root cause, impact, and remediation details.
4. 2026-10-09 Autoridad de Certificacion Firmaprofesional — Reported completion of the action item to extend OCSP monitoring to validate response signatures and issuer-specific responder authorization.
5. 2026-10-16 Autoridad de Certificacion Firmaprofesional — Reported completion of the remaining action item to extend compliance review and change-management procedures for CA retirement and OCSP service changes.
6. 2026-10-19 Autoridad de Certificacion Firmaprofesional — Posted the closure summary and requested that the bug be closed.