TWCA self-reported incident: non-critical basicConstraints in delegated OCSP responder certificates
TWCA reported that it found delegated OCSP responder certificates with a non-critical basicConstraints extension, which it said is contrary to TLS Baseline Requirements Section 7.1.2.8.2. The case began after TWCA received a third-party report on 2026-10-09 and then verified the issue internally. TWCA’s full incident report says the scope expanded to 11 valid affected OCSP responder certificates, with 26 total affected certificates including expired ones. TWCA suspended OCSP responder certificate issuance on 2026-10-09 while it corrected the profile, but it did not stop TLS subscriber certificate issuance. The report states the last affected certificate was replaced on 2026-10-14, and TWCA said it would provide a full incident report by 2026-10-23; the thread also includes the full incident report and an attached CSV inventory.
- TWCA received a third-party report about delegated OCSP responder certificates with a non-critical basicConstraints extension.
- TWCA suspended OCSP responder certificate issuance while it corrected the profile.
- TWCA replaced the last of the affected OCSP responder certificates.
- TWCA posted its full incident report and attached an OCSP responder certificate inventory CSV.
- Taiwan-CA Inc. (TWCA) — TWCA filed a preliminary incident report describing the third-party report, its verification of the issue, and its plan to replace affected certificates.
- Taiwan-CA Inc. (TWCA) — o**********a@twca.com.tw added the attachment OCSPResponderCertificates.csv.
- Taiwan-CA Inc. (TWCA) — TWCA posted the full incident report, including scope, timeline, and remediation details.