NAVER Cloud Trust Services: OCSP responses with empty responseExtensions
This case concerns a third-party Certificate Problem Report about OCSP responses signed by NAVER Cloud Trust Services that encoded the `responseExtensions` field as an empty SEQUENCE. The reporter stated that RFC 6960 requires `responseExtensions` to be omitted when there are no extensions, and NAVER Cloud Trust Services confirmed the issue the same day it was received. The bug says the problem affects five OCSP responders and that no certificates are affected; the impact is limited to OCSP response encoding. NAVER Cloud Trust Services said the issue was not yet contained at the time of the initial report and planned to modify its OCSP responder software so the field is omitted when empty. The company also said it would post a Full Incident Report within 14 days of disclosure, and later commented that it was concluding the investigation and preparing that report by 2026-10-23.
- A third party reported OCSP responses with an empty `responseExtensions` field from NAVER Cloud Trust Services responders.
- NAVER Cloud Trust Services confirmed the OCSP encoding issue and said it affected five responders.
- NAVER Cloud Trust Services said it was concluding the investigation and preparing the Full Incident Report.
- Navercorp representative — NAVER Cloud Trust Services filed a preliminary incident report describing the OCSP `responseExtensions` encoding issue, its scope, and planned remediation.
- Navercorp representative — NAVER Cloud Trust Services said it was concluding the investigation and would post the Full Incident Report within the 14-day timeframe.