ACCV OCSP archiveCutoff extension encoded in the wrong OCSP field
This case concerns ACCV’s OCSP responder encoding of the optional `id-pkix-ocsp-archive-cutoff` extension in OCSP responses. A third party reported that the extension was being placed in the global `ResponseData.responseExtensions` field instead of the `SingleResponse.singleExtensions` field required by RFC 6960. ACCV reproduced the issue, confirmed the encoding problem, and stated that it did not identify incorrect certificate status information or subscriber certificate misissuance. On 2026-10-19, ACCV said it deployed a configuration correction so the extension is now included in the RFC-compliant field. ACCV said the technical issue is mitigated and that it is completing validation and preparing a Full Incident Report due by 2026-10-26.
- A third party reported that ACCV OCSP responses encoded archiveCutoff in the wrong OCSP field.
- ACCV deployed a correction so archiveCutoff is now placed in SingleResponse.singleExtensions.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — ACCV filed a preliminary incident report describing the OCSP encoding issue, its reproduction, and planned remediation steps.
- Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) — ACCV reported that it deployed a correction, considered the issue mitigated, and said the Full Incident Report is still pending.