1579413 - GlobalSign: OCSP Responder Returns invalid values for Some Precertificates

Status: RESOLVED INVALID

(CA Program :: CA Certificate Compliance, defect)

Description

[douglas.beattie]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36

Steps to reproduce:

Based on announcements by DigiCert and Let's Encrypt, GlobalSign has found that our Precertificates without corresponding certificates also return Unauthorized or Unknown. We're working with PrimeKey on a patch and are also updating our own OCSP services to return the proper values.

Here are 2 examples:
https://crt.sh/?id=1707464536&opt=ocsp
https://crt.sh/?id=1725532369&opt=ocsp

Comment 1

[Ryan Sleevi]

Doug: Thanks for filing this issue early, as you became aware, rather than waiting until you believe it's been fully resolved.

It's unclear if this was meant to be the extent of the incident report or whether GlobalSign is preparing further updates. If planning to provide additional details, can you provide a timeline for that?

Comment 2

[douglas.beattie]

Ryan: We'll be providing regular updates and detail next week and finish up with an incident report that follows the Mozilla template.

As I thought about this more, our OCSP responses are OK and are not really the issue. The core problem is that Mozilla says CAs MUST NOT issue certificates that have cRLDistributionPoints or OCSP authorityInfoAccess extensions for which no operational CRL or OCSP service exists. Since precertificates are considered certificates, we need to provide operational OCSP and CRL services for them, which isn't currently possible. This is going to take a bit to complete, but we'll keep this ticket updated with the status.

Comment 3

[Ryan Sleevi]

Thanks. Please provide weekly updates on the progress to a complete timeline for remediation.

Comment 4

[douglas.beattie]

Status update:

• PrimeKey has opened a ticket to resolve this in the November time-frame in EJBCA 7.3.1
• We've opened tickets for our GlobalSign developed OCSP service to store the precertificates in our main certificate database so they are treated the same as a certificate when it comes to OCSP services. This will permit proper responses to be provided.

Our next status update should be in about a month. We continue to follow the discussions on mdsp list and updates to the Mozilla policy.

Comment 5

[Wayne Thayer]

Thank you for the incident report. Given the outcome of the discussion on the mozilla.dev.security.policy list [1], I'm resolving this incident as INVALID.

[1] https://groups.google.com/d/msg/mozilla.dev.security.policy/LC_y8yPDI9Q/tPrL7rNkBAAJ