Kamu SM: Non-BR-Compliant OCSP Response Validity Interval
Kamu SM reported that it received an external Certificate Problem Report about OCSP responses for its subscriber certificates having a validity interval shorter than the Baseline Requirements allow. The report said the affected OCSP responder returned nextUpdate values only one minute after thisUpdate for subscriber certificates issued under the Surum 3 hierarchy. Kamu SM said it investigated the issue, found that the problem also affected the Surum 2 sub-CA, and determined the issue came from the OCSP responder application configuration. The bug states the issue was resolved on 2026-10-09 at 15:00 UTC, the same day the report was received, and that responses now conform to BR Section 4.9.9. Kamu SM also said it plans to add an automated check for OCSP response validity intervals and will publish a full incident report by 2026-10-23.
- Kamu SM received a Certificate Problem Report about OCSP responses with a validity interval shorter than eight hours.
- Kamu SM resolved the OCSP responder configuration issue and restored BR-compliant response validity intervals.
- Kamu SM posted an interim report and said a full incident report would follow by 2026-10-23.
- Tubitak representative — Kamu SM opened a preliminary incident report describing the external CPR, the affected OCSP responder, and the ongoing investigation.
- Tubitak representative — Kamu SM provided an interim update stating the issue was fixed, the scope included another sub-CA, and preventive monitoring changes were planned.