Open Bug 2080806 Opened 12 days ago Updated 5 days ago

Actalis: Non-compliant OCSP responses and OCSP responder certificate

Categories

(CA Program :: CA Certificate Compliance, task)

Product:
CA Program
Component:
CA Certificate Compliance
Type:
task

Tracking

(Not tracked)

Status:
ASSIGNED

People

(Reporter: nicolo.papi, Assigned: nicolo.papi)

Details

(Whiteboard: [ca-compliance] [ocsp-failure])

Preliminary Incident Report

Summary

  • Incident description: On 2026-10-09 h 14.30 CEST, Actalis received an external report concerning empty singleExtensions fields in OCSP responses and a prohibited cRLDistributionPoints extension in an OCSP responder certificate. The two reported responders are associated with the SubCAs Actalis OV TLS Server RSA CA 2025 and Actalis Organization Validated Server CA G3. The scope and causes of the reported issues are under investigation. We will provide further details on the investigation and corrective actions in the Full Incident Report.
  • Relevant policies: CA/B Forum TLS BR Sections 4.9.9 and 7.1.2.8; RFC 6960 section 4.2.1, Actalis CP/CPS sections 4.9.9 and 7.3.
  • Source of incident disclosure: Third Party reported.
Assignee: nobody → nicolo.papi
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true
Whiteboard: [ca-compliance] [ocsp-failure]

Weekly Update

We are continuing our internal investigation and will publish the Full Incident Report within the required timeframe.
We will provide an update if any material findings emerge in the meantime.

You need to log in before you can comment on or make changes to this bug.