SwissSign: Incorrectly encoded OCSP extended-revoke extension

SwissSign reported that its OCSP responder encoded the extended-revoke extension incorrectly by using an empty value instead of the ASN.1 NULL required by RFC 6960. The issue was first reported by a third party, and SwissSign confirmed it after receiving the problem report. SwissSign stated that the affected OCSP responses were still correctly signed and that it had not identified any client interoperability failure. The full incident report says the non-compliance began on 2023-09-22, was identified on 2026-10-06, and is expected to end on or before 2026-11-30. SwissSign also said certificate issuance was not affected and listed software fixes, added compliance test cases, and OCSP lint monitoring as action items.

1. 2023-09-22 SwissSign began using the new CA system in production, and the OCSP encoding issue was present from that point.
2. 2026-10-06 An external third party reported the OCSP response encoding problem to SwissSign.
3. 2026-10-07 SwissSign confirmed the issue to the external third party.
4. 2026-10-20 SwissSign posted the full incident report and listed remediation action items.

1. 2026-10-08 SwissSign AG — Roman Fischer posted a preliminary incident report describing the incorrect OCSP extended-revoke encoding and noting that the source of disclosure was a third party.
2. 2026-10-20 SwissSign AG — SwissSign posted the full incident report with the timeline, root cause analysis, and action items.