Closed Bug 2031281 Opened 6 months ago Closed 4 months ago

CFCA: OCSP Responder Certificate Profile Deviations and OCSP Service Issues

Categories

(CA Program :: CA Certificate Compliance, task)

Product:
CA Program
Component:
CA Certificate Compliance
Type:
task

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: songxinlei, Assigned: songxinlei)

Details

(Whiteboard: [ca-compliance] [crl-failure] [ocsp-failure])

Attachments

(3 files)

EVRCA-ocsp-responder.pem
1.74 KB, application/x-x509-ca-cert
Details
EVOCA-ocsp-responder.pem
1.39 KB, application/x-x509-ca-cert
Details
OVOCA-ocsp-responder.pem
1.39 KB, application/x-x509-ca-cert
Details

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36

Steps to reproduce:

Preliminary Incident Report

Summary

  • Incident description: On April 7, 2026, CFCA received an email from security researcher reporting multiple non-conformance issues with CFCA's PKI infrastructure against the CA/Browser Forum Baseline Requirements. The reported issues include: (1) OCSP responder certificate profile deviations: Key Usage contains unauthorized "nonRepudiation" flag, missing required "id-pkix-ocsp-nocheck" extension, KeyUsage and basicConstraints not marked as critical, and inclusion of prohibited CRL Distribution Points extension; (2) OCSP service returning "unauthorized" for Subordinate CA certificate status queries despite the certificate containing an OCSP AIA extension; (3) CRL signature algorithm ASN.1 encoding error where the signatureAlgorithm field lacks the required NULL parameter.
  • Relevant policies:
    • BR 7.1.2.8 - OCSP Responder Certificate Profile;
    • BR 7.1.2.8.7 - OCSP Responder Key Usage;
    • BR 7.1.2.8.6 - id-pkix-ocsp-nocheck Extension;
    • BR 7.1.2.8.4 - OCSP Responder Basic Constraints;
    • BR 7.1.2.8.2 - cRLDistributionPoints;
    • BR 4.9.9 - OCSP response for Subordinate CA Certificate;
    • RFC 4055 Section 5 (which is referenced by RFC 5280 Section 4.1.2.3) - AlgorithmIdentifier
  • Source of incident disclosure: Third-party Reported, since it's reported to individual CFCA employees rather than through the official public Certificate Problem Report (CPR) mechanism documented our CP/CPS, this issues not being detected and processed in a timely manner

Update Preliminary Incident Report:

Preliminary Incident Report

Summary

  • Incident description: On April 7, 2026, CFCA received an email from security researcher reporting multiple non-conformance issues with CFCA's PKI infrastructure against the CA/Browser Forum Baseline Requirements. The reported issues include: (1) OCSP responder certificate profile deviations: Key Usage contains unauthorized "nonRepudiation" flag, missing required "id-pkix-ocsp-nocheck" extension, KeyUsage and basicConstraints not marked as critical, and inclusion of prohibited CRL Distribution Points extension; (2) OCSP service returning "unauthorized" for Subordinate CA certificate status queries despite the certificate containing an OCSP AIA extension; (3) CRL signature algorithm ASN.1 encoding error where the signatureAlgorithm field lacks the required NULL parameter.
  • Relevant policies:
    • BR 7.1.2.8 - OCSP Responder Certificate Profile;
    • BR 7.1.2.8.7 - OCSP Responder Key Usage;
    • BR 7.1.2.8.6 - id-pkix-ocsp-nocheck Extension;
    • BR 7.1.2.8.4 - OCSP Responder Basic Constraints;
    • BR 7.1.2.8.2 - cRLDistributionPoints;
    • BR 4.9.9 - OCSP response for Subordinate CA Certificate;
    • RFC 4055 Section 5 (which is referenced by RFC 5280 Section 4.1.2.3) - AlgorithmIdentifier
  • Source of incident disclosure: Third-party Reported (identity to be disclosed pending reporter consent). The disclosure was reported to individual CFCA employees rather than through the official public Certificate Problem Report (CPR) mechanism documented in our CP/CPS, resulting in these issues not being detected and processed in a timely manner
Assignee: nobody → songxinlei
Status: UNCONFIRMED → ASSIGNED
Type: defect → task
Ever confirmed: true
Whiteboard: [ca-compliance] [crl-failure] [ocsp-failure]

If CA compliance incidents or issues have distinct and unrelated root causes, then they should be tracked in separate bugs.

Hi, we've received reporter consent, so updating the preliminary incident report as follows:

Preliminary Incident Report

Summary

  • Incident description: On April 7, 2026, CFCA received an email from security researcher reporting multiple non-conformance issues with CFCA's PKI infrastructure against the CA/Browser Forum Baseline Requirements. The reported issues include: (1) OCSP responder certificate profile deviations: Key Usage contains unauthorized "nonRepudiation" flag, missing required "id-pkix-ocsp-nocheck" extension, KeyUsage and basicConstraints not marked as critical, and inclusion of prohibited CRL Distribution Points extension; (2) OCSP service returning "unauthorized" for Subordinate CA certificate status queries despite the certificate containing an OCSP AIA extension; (3) CRL signature algorithm ASN.1 encoding error where the signatureAlgorithm field lacks the required NULL parameter.
  • Relevant policies:
    • BR 7.1.2.8 - OCSP Responder Certificate Profile;
    • BR 7.1.2.8.7 - OCSP Responder Key Usage;
    • BR 7.1.2.8.6 - id-pkix-ocsp-nocheck Extension;
    • BR 7.1.2.8.4 - OCSP Responder Basic Constraints;
    • BR 7.1.2.8.2 - cRLDistributionPoints;
    • BR 4.9.9 - OCSP response for Subordinate CA Certificate;
    • RFC 4055 Section 5 (which is referenced by RFC 5280 Section 4.1.2.3) - AlgorithmIdentifier
  • Source of incident disclosure: Third-party Reported by xipki. The disclosure was reported to individual CFCA employees rather than through the official public Certificate Problem Report (CPR) mechanism documented in our CP/CPS, resulting in these issues not being detected and processed in a timely manner
Summary: CFCA: OCSP Responder Certificate Profile Deviations and CRL Encoding Issues → CFCA: OCSP Responder Certificate Profile Deviations and OCSP Service Issues

(In reply to incident-reporting from comment #2)

If CA compliance incidents or issues have distinct and unrelated root causes, then they should be tracked in separate bugs.

Thank you for the guidance on separating bugs with distinct root causes.

After our preliminary analysis, we have identified two categories of issues affecting different infrastructure components:

Category 1: OCSP-Related Issues

  • OCSP Responder certificate profile deviations
  • OCSP service functionality issues
  • Affected: 4 OCSP Responder certificates

Category 2: CRL-Related Issues

  • CRL encoding issues (signatureAlgorithm ASN.1 encoding)
  • Affected: 4 CRLs (EV RCA Root CA + EV/OV/DV OCA Subordinate CAs)

Actions Taken:

  1. Created separate bug for CRL issues

    • Bug #2033412: CFCA: CRL signatureAlgorithm Missing NULL Parameter (RFC 4055 Section 5)

  2. Rename this bug to focus on OCSP issues

    • Current title: "CFCA: OCSP Responder Certificate Profile Deviations and CRL Encoding Issues"
    • Updated title: "CFCA: OCSP Responder Certificate Profile Deviations and OCSP Service Issues"

Thank you for your guidance.

Full Incident Report

Summary

  • CA Owner CCADB unique ID: A000272
  • Incident description: CFCA OCSP Responder certificates for EV RCA, EV OCA, OV OCA, and DVOCA contained multiple BR 7.1.2.8 profile deviations including unauthorized Key Usage flags, missing required extensions, prohibited extensions, and non-critical extension marking. Additionally, DVOCA(Subordinate CA) certificate OCSP status query returns "unauthorized".
  • Timeline summary:
    • Non-compliance start date: 2022-10-17(DVOCA Certificate issued)
    • Non-compliance identified date: 2026-04-07
    • Non-compliance end date: 2026-05-26
  • Relevant policies:
    • BR 7.1.2.8 (OCSP Responder Certificate Profile)
    • BR 7.1.2.8.2 (Prohibited: CRL Distribution Points extension)
    • BR 7.1.2.8.4 (Critical extension marking requirements)
    • BR 7.1.2.8.6 (Required: id-pkix-ocsp-nocheck extension)
    • BR 7.1.2.8.7 (Prohibited Key Usage: nonRepudiation)
    • BR 4.9.9 (OCSP responder must provide certificate status)
  • Source of incident disclosure: Third Party Reported by XiPKI

Impact

  • Total number of certificates: 3 OCSP Responder certificates (EV RCA, EV OCA, OV OCA) + 1 Subordinate CA certificate (DVOCA - OCSP status query issue only)

  • Total number of "remaining valid" certificates: 3 OCSP Responder certificates remain valid pending remediation

  • Affected certificate types:

    • OCSP Responder Certificates (infrastructure certificates)
    • Subordinate CA Certificate (DVOCA) - OCSP status query issue only

  • Incident heuristic: Affected OCSP Responder certificates files will be uploaded as attachments to this Bug for verification.

  • Was issuance stopped in response to this incident, and why or why not?: No. OCSP Responder certificates are infrastructure certificates. Subscriber certificate issuance continues unaffected.

  • Analysis: N/A

  • Additional considerations: N/A

Timeline

All times in this timeline are in Beijing Time (CST, UTC+8) unless explicitly marked.

Date Time Event
2012-08-08 11:07 EV RCA (Root CA) certificate issued
2012-08-08 13:50 EV RCA & EV OCA OCSP certificate templates created
2014-10-29 EV RCA OCSP certificate template last adjustment
2015-08-03 09:44 OV OCA & DVOCA OCSP certificate templates created (DVOCA certificate not issued)
2023-09-15 BR 2.0.0 took effect
2026-04-02 23:28 CET (UTC+1) Reporter (XiPKI) sends first email to cps@cfca.com.cn - Reports OCSP "unauthorized" issue
2026-04-03 23:43 CET (UTC+1) Reporter sends follow-up email - Adds OCSP certificate profile issues and CRL encoding issues
2026-04-07 18:02 Reporter forwards emails to CFCA employees (non-official channel)
2026-04-09 03:31 CPR platform submission - WebHook notification failed (content exceeded 4096 char limit)
2026-04-13 ~09:00 CFCA discovers forwarded email and processes incident
2026-04-20 18:35 CRL issues separated to Bug 2033412 per Mozilla recommendation

Related Incidents

After searching Mozilla Bugzilla, we found related OCSP compliance incidents from other CA Owners:

Bug Date Description
1996857 2025-10-28 IZENPE: OCSP Responder certificates included nonRepudiation Key Usage (BR 7.1.2.8.7 violation).
1879552 2024-02-08 Microsoft PKI Services: OCSP Responder returned "unknown" status due to database synchronization failure.
1653680 2020-07-14 IdenTrust: OCSP Responder certificate missing id-pkix-ocsp-nocheck extension (BR 7.1.2.8.6 violation).
1649951 2020-07-02 DigiCert: OCSP Delegated Responder certificates missing id-pkix-ocsp-nocheck extension.
1649964 2020-07-02 PKIoverheid: Incorrect OCSP Delegated Responder Certificate.
1649963 2020-07-02 Atos: Incorrect OCSP Delegated Responder Certificate.
1649962 2020-07-02 SECOM: Incorrect OCSP Delegated Responder Certificate.
1649961 2020-07-02 Actalis: Incorrect OCSP Delegated Responder Certificate.
1649947 2020-07-02 Microsec: Incorrect OCSP Delegated Responder Certificate.
1649945 2020-07-02 HARICA: Incorrect OCSP Delegated Responder Certificate.
1649944 2020-07-02 Camerfirma: Incorrect OCSP Delegated Responder Certificate.

Root Cause Analysis

Contributing Factor #1: OCSP Responder Certificate Profile Deviations (BR 7.1.2.8)

  • Description: OCSP certificate templates created in 2012-2015 have been used for issuance without review against subsequent BR updates. New requirements introduced over time were not incorporated into templates. While OCSP services remained operational, these deviations exposed systemic deficiencies in CA infrastructure certificate management. Remediation completed: after each BR update, all certificate templates are reviewed for compliance; quarterly self-audit includes template review; process formalized as standard procedure.

  • Timeline:

    • 2012-08-08 11:07: EV RCA (Root CA) certificate issued
    • 2012-08-08 13:50: EV RCA & EV OCA OCSP certificate templates created
    • 2014-10-29: EV RCA OCSP template last adjustment
    • 2015-08-03 09:44: OV OCA & DVOCA OCSP certificate templates created
    • 2026-04-07: External researcher discovers issues

  • Detection: External security researcher (XiPKI) reported these problems. The issue persisted undetected for 10-12 years because infrastructure certificates were not reviewed against evolving BR requirements.

  • Interaction with other factors: Certificate profile errors + Internal checks not covering OCSP/CRL contributed to this problem undetected.

  • Root Cause Analysis methodology used: 5-Whys

Contributing Factor #2: Manual process missed for updating OCSP Service for certificated issed by offline Root CA

  • Description: OCSP service returns "unauthorized" status when queried for DVOCA Subordinate CA certificate status. Database sync operation failure occurred when DVOCA Subordinate CA certificate was issued in August 2015, because we haven't issued any DV subscriber certificates, this problem remained undetected from 2015-2026 without causing actual impact.

  • Timeline:

    • 2022: CFCA DV OCA issued by our RCA, but missed the steps to update OCSP service.
    • 2026-04-07: External researcher discovers issue

  • Detection: External security researcher discovered via OCSP query testing. Because there haven't conducted periodic OCSP functional testing, and quarterly self-audit did not include Subordinate CA certificate status queries, and DVOCA had not issued subscriber certificates so the issue had no visible operational impact. After interviewing with our OCSP and CA operator and develop teams, we identified that there's an manual process to update OCSP lookup database for certificates issued by offline Root CA.

  • Interaction with other factors: Related to Factor #3: if quarterly self-audit included OCSP functional testing, this issue would have been detected earlier).

  • Root Cause Analysis methodology used: Direct investigation (database sync testing) + Technical constraint assessment

Contributing Factor #3: Internal Compliance Checks Not Covering Infrastructure Certificates

  • Description: Internal compliance checking was focused on subscriber certificates, missed the infrastructure certificates because the requirements for infrastructure certificates are stable and low-risk. However, BR requirements evolved over time, and infrastructure certificates were not reviewed against new requirements. Additionally, no OCSP functional testing was conducted, leads to this issue undetected. Our quarterly self-audit now includes OCSP functional testing for Subordinate CA certificate status queries.

  • Timeline:

    • 2012-2015: OCSP certificate profiles created and updated
    • 2026-04-07: External researcher discovers issues that internal systems missed

  • Detection: External researcher report revealed that infrastructure certificates were not reviewed against evolving BR requirements. After inspection from the database, and interviewing with our operation team, we found that the certificate profile was created long time ago, and have been using these profiles to issue OCSP certificates.

  • Interaction with other factors: This factor enabled Factor #1 and Factor #2 to remain undetected. If infrastructure certificates had been reviewed against BR changes, Factor #1 template deviations would have been identified. If OCSP functional testing had been conducted, Factor #2 database sync issue would have been detected.

  • Root Cause Analysis methodology used: Process gap analysis and interviewing with related team members

Contributing Factor #4: CPR platform WebHook notification content exceeded size limit and errored-out

  • Description: Reporter submitted issue report via CPR platform on 2026-04-09, but WebHook notification failed (enterprise WeChat notification not received), causing CFCA to not detect the report promptly. After reviewing service logs, we found that our CPR platform WebHook notification content exceeded 4096 character limit, causing notification delivery failure.

  • Timeline:

    • 2026-04-09 03:31:54: Reporter submitted via CPR platform
    • 2026-04-09: WebHook notification failed (enterprise WeChat not received)
    • 2026-04-13 ~09:00: CFCA discovered report via forwarded email

  • Detection: CFCA internal investigation (log analysis, configuration check) discovered the WebHook failure. The failure was not detected promptly because it's been treated as success if one of the WebHook or Email calls works.

  • Root Cause Analysis methodology used: Direct investigation (log analysis, configuration check)

Lessons Learned

What went well

  • N/A

What didn't go well

  • BR change monitoring: Updates not reviewed against infrastructure certificates
  • RCA offline zone Sub CA issuance: Manual operation did not execute OCSP database sync (operational manual lacked explicit procedure)
  • CPR platform WebHook notification failed

Where we got lucky

  • Reporter used responsible disclosure and tried many ways to get in touch with us.
  • No subscriber certificates affected
  • OCSP services remain functional despite certificate profile deviations

Additional

  • N/A

Action Items

Action Item Kind Corresponding Root Cause(s) Evaluation Criteria Due Date Status
Re-issue OCSP Responder certificates with correct BR 7.1.2.8 profile (EV RCA + EV/OV OCA) Prevent #1 New certificates pass compliance check 2026-05-26 Ongoing
Improve "New CA Creation Guide" with OCSP database sync checklist Prevent #2 Guide includes data sync checklist (OA process ensures execution) 2026-04-28 Complete
Add manual certificate checking for CA infrastructure certificates in deployment process (OCSP) Detect #3 OCSP certificates pass manual certificate check before issuance 2026-05-14 Complete
Establish systematic BR change review process covering all certificate types Prevent #1, #3 BR changes reviewed within 7 days 2026-04-24 Complete
Add OCSP service functional testing (Subordinate CA certificate queries) Detect #2, #3 Quarterly OCSP testing during self-audit 2026-04-24 Complete
Fix CPR platform WebHook notification mechanism (content truncation handling) Prevent #4 WebHook notifications succeed (truncate if exceeds limit) 2026-04-16 Complete
Enhance CPR platform user confirmation functionality Prevent #4 CPR submission returns ticket number and confirmation email 2026-05-31 Ongoing

Appendix

Affected OCSP Responder Certificates

The following is the complete corpus of OCSP Responder certificates affected by this incident (3 certificates total).

The EV RCA, EV OCA and OV OCA OCSP Responder Certificate are uploaded above.

Hi, the action items are going as planned, no other updates yet.

Hi, we're monitoring this bug. No furthur updates yet.

Hi, the action items are progressing as planned, no furthur updates yet.

Hi, the action items are progressing as planned, no furthur updates yet.

Hi, the OCSP Responder certificates has been reissued, so we're updating the Action Items as follows:

Action Item Kind Corresponding Root Cause(s) Evaluation Criteria Due Date Status
Re-issue OCSP Responder certificates with correct BR 7.1.2.8 profile (EV RCA + EV/OV OCA) Prevent #1 New certificates pass compliance check 2026-05-26 Complete
Improve "New CA Creation Guide" with OCSP database sync checklist Prevent #2 Guide includes data sync checklist (OA process ensures execution) 2026-04-28 Complete
Add manual certificate checking for CA infrastructure certificates in deployment process (OCSP) Detect #3 OCSP certificates pass manual certificate check before issuance 2026-05-14 Complete
Establish systematic BR change review process covering all certificate types Prevent #1, #3 BR changes reviewed within 7 days 2026-04-24 Complete
Add OCSP service functional testing (Subordinate CA certificate queries) Detect #2, #3 Quarterly OCSP testing during self-audit 2026-04-24 Complete
Fix CPR platform WebHook notification mechanism (content truncation handling) Prevent #4 WebHook notifications succeed (truncate if exceeds limit) 2026-04-16 Complete
Enhance CPR platform user confirmation functionality Prevent #4 CPR submission returns ticket number and confirmation email 2026-05-31 Ongoing

Hi, the Action Item about CPR is completed, all action items are done, here's the updated Action Items table:

Action Item Kind Corresponding Root Cause(s) Evaluation Criteria Due Date Status
Re-issue OCSP Responder certificates with correct BR 7.1.2.8 profile (EV RCA + EV/OV OCA) Prevent #1 New certificates pass compliance check 2026-05-26 Complete
Improve "New CA Creation Guide" with OCSP database sync checklist Prevent #2 Guide includes data sync checklist (OA process ensures execution) 2026-04-28 Complete
Add manual certificate checking for CA infrastructure certificates in deployment process (OCSP) Detect #3 OCSP certificates pass manual certificate check before issuance 2026-05-14 Complete
Establish systematic BR change review process covering all certificate types Prevent #1, #3 BR changes reviewed within 7 days 2026-04-24 Complete
Add OCSP service functional testing (Subordinate CA certificate queries) Detect #2, #3 Quarterly OCSP testing during self-audit 2026-04-24 Complete
Fix CPR platform WebHook notification mechanism (content truncation handling) Prevent #4 WebHook notifications succeed (truncate if exceeds limit) 2026-04-16 Complete
Enhance CPR platform user confirmation functionality Prevent #4 CPR submission returns ticket number and confirmation email 2026-05-31 Complete

The closure report will be updated soon, no other updates.

As all Action Items has been completed, we're updating the Report Closure.

Report Closure Summary

  • Incident description: CFCA OCSP Responder certificates (EV RCA, EV OCA, OV OCA) contained multiple BR 7.1.2.8 profile deviations: unauthorized Key Usage flag (nonRepudiation), missing id-pkix-ocsp-nocheck extension, prohibited CRL Distribution Points extension, and non-critical extension marking. DVOCA Subordinate CA certificate OCSP queries returned "unauthorized" due to an offline Root CA database sync failure. A CPR platform WebHook notification also failed due to content exceeding the 4096-character limit.

  • Incident Root Cause(s):

    1. OCSP certificate templates created in 2012-2015 have been used for issuance without review against subsequent BR updates.
    2. Manual process missed for updating OCSP Service for certificated issued by offline Root CA, database sync operation failure occurred when DVOCA Subordinate CA certificate was issued in August 2015.
    3. Internal compliance checking was focused on subscriber certificates, missed the infrastructure certificates because the requirements for infrastructure certificates are stable and low-risk.
    4. CPR platform WebHook silently failed when submission content exceeded the 4096-character limit.

  • Remediation description: All 3 OCSP Responder certificates were revoked and re-issued with correct BR 7.1.2.8 profiles. The "New CA Creation Guide" was updated with an OCSP database sync checklist. Mandatory pre-issuance checking for CA infrastructure certificates and quarterly OCSP functional testing were added. A systematic BR change review process covering all certificate types was established. The CPR platform WebHook was fixed to truncate oversized content and deliver full content via email, and a user-facing confirmation (ticket number) was added.

  • Commitment summary: CFCA commits to ongoing quarterly OCSP functional testing, 7-day BR change review for all certificate types, mandatory pre-issuance verifying for all CA infrastructure certificates.

All Action Items disclosed in this report have been completed as described, and we request its closure.

This is a final call for comments or questions on this Incident Report.

Otherwise, it will be closed on approximately 2026-06-16.

Whiteboard: [ca-compliance] [crl-failure] [ocsp-failure] → [close on 2026-06-16] [ca-compliance] [crl-failure] [ocsp-failure]
Status: ASSIGNED → RESOLVED
Closed: 4 months ago
Resolution: --- → FIXED
Whiteboard: [close on 2026-06-16] [ca-compliance] [crl-failure] [ocsp-failure] → [ca-compliance] [crl-failure] [ocsp-failure]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: