Sectigo third-party report of noncompliant ECDSA OCSP response encoding and CPR non-response
This case concerns Sectigo’s handling of a third-party report about OCSP responses that were encoded with a NULL parameters field in ECDSA AlgorithmIdentifier values, which the reporter said violates RFC 5758 and TLS BR 7.1.3.2.2. The reporter stated they had submitted the issue through Sectigo’s problem reporting mechanism more than 24 hours earlier and had not received a response, so they opened this bug. Sectigo replied that it was investigating the OCSP misbehaviour and said it had not found the CPR email in its mailbox, then said it would contact the reporter privately. Sectigo later filed a preliminary incident report and then a full incident report describing the OCSP encoding issue, its investigation, and the deployment of a fix. The bug remained assigned, and Sectigo later said its remaining action items were complete and requested closure.
- A third party reported that Sectigo-operated OCSP responders were serving ECDSA OCSP responses with an invalid NULL parameters field.
- Sectigo said it was investigating the OCSP misbehaviour and had not found the CPR email in its mailbox.
- Sectigo deployed a fix to production for the OCSP encoding issue.
- Sectigo filed a full incident report describing the OCSP encoding problem, root cause, and remediation.
- Sectigo said its remaining action items were complete and requested closure.
- Community commenter — Reported incorrect OCSP responses, said a CPR had been submitted over 24 hours earlier without response, and opened the bug.
- Sectigo — Thanked the reporter, said Sectigo was investigating, and said it had not found any CPR email yet.
- Sectigo — Posted a preliminary incident report stating the issue was discovered through this Bugzilla report and that a separate bug was opened to address the CPR-response matter.
- Sectigo — Posted the full incident report with timeline, root cause analysis, and related incident links.
- Community commenter — Noted that a subscriber had contacted Sectigo support around 2026-09-10, but said it was distinct from a CPR.
- Sectigo — Said development was underway on linting enhancements and that a support request had been filed under the wrong component.
- Sectigo — Requested a next-update date of 2026-11-01.
- Sectigo — Said both remaining action items were complete and requested closure.