AIKIDO-2026-293812

TL;DR

In OcspServerCertificateValidator, when an OCSP response omits nextUpdate the staleness check is skipped, so arbitrarily stale responses pass. A subsequent NullPointerException fires inside a promise listener rather than exceptionCaught, so the validator removes itself and fails silently without emitting a validation event. Because the TLS handshake complete event precedes async OCSP validation, applications cannot distinguish success from silent failure and may accept revoked certificates. The fix allows a missing nextUpdate as valid only inside a clock skew window around thisUpdate and sends listener failures through exceptionCaught.