iTrusChina: OCSP response ECDSA signatureAlgorithm encoded with NULL parameters
iTrusChina reported that its OCSP responders for test websites returned ECDSA signatures with NULL parameters in the AlgorithmIdentifier, which it said violates BR Section 7.1.3.2.2 and RFC 5758. The issue was first identified on 2026-10-09 after a third-party Certificate Problem Report notified the CA. iTrusChina said the affected responders included "wtocsp-cdn.itrus.com.cn-ECC EV" and "wtocsp-cdn.itrus.com.cn-ECC OV," and that the same underlying OCSP response generation code affected its _vTrus ECC Root CA_ and three ICAs. The CA said it completed root cause analysis, prepared a remedial action plan, and updated the OCSP response generation program on 2026-10-19. The report states the incident involved no misissuances and that issuance was not stopped. The bug remains assigned, and the thread includes a full incident report with a timeline and related incident references.
- The OCSP response generation program with the encoding issue was first deployed.
- A third-party CPR notified iTrusChina that its test websites’ OCSP responses used ECDSA signatureAlgorithm with NULL parameters.
- iTrusChina updated the OCSP response generation program and said the issue was fixed.
- iTrusChina Co., Ltd. — iTrusChina filed a preliminary incident report saying a CPR had reported OCSP responses with ECDSA signatureAlgorithm NULL parameters and that it would disclose a full report by 2026-10-23.
- iTrusChina Co., Ltd. — iTrusChina said root cause analysis was complete and remedial actions were underway, with the full incident report still being drafted.
- iTrusChina Co., Ltd. — iTrusChina submitted the full incident report, describing the affected responders, root cause, timeline, and remediation.