Actalis: External report of non-compliant OCSP responses and OCSP responder certificate issue

Actalis opened this case after receiving an external report on 2026-10-09 about OCSP response and OCSP responder certificate issues. The report alleged empty singleExtensions fields in OCSP responses and a prohibited cRLDistributionPoints extension in an OCSP responder certificate. Actalis said the two reported responders are associated with the SubCAs Actalis OV TLS Server RSA CA 2025 and Actalis Organization Validated Server CA G3. In its preliminary incident report, Actalis said the scope and causes were under investigation and that it would provide further details in a Full Incident Report. In a later weekly update, Actalis said the internal investigation was continuing and that the Full Incident Report would be published within the required timeframe.

1. 2026-10-09 Actalis received an external report about empty singleExtensions fields in OCSP responses and a prohibited cRLDistributionPoints extension in an OCSP responder certificate.
2. 2026-10-12 Actalis filed a preliminary incident report describing the reported OCSP issues and said the scope and causes were under investigation.
3. 2026-10-19 Actalis said its internal investigation was continuing and that it would publish the Full Incident Report within the required timeframe.

1. 2026-10-12 Staff representative — Actalis posted a preliminary incident report stating that the issue was externally reported, naming the affected SubCAs, and saying the investigation was ongoing.
2. 2026-10-19 Staff representative — Actalis provided a weekly update saying the internal investigation was continuing and the Full Incident Report would be published within the required timeframe.