There's also an incident reported on BugZilla that's related to this: 2072647 - Sectigo: Violation of TLS BR 7.1.3.2.2 in OCSP responses
I have received a couple of responses from Sectgo and provided them additional information. I will provide an update once they provide me one.
Hello, just checking in to see if Sectigo got back to you with a timeline or update.
I heard back from a contact on Sectigos T3 Team, and they reported the OCSP issue related to the NULL parameter has been fixed.
I just tested with the 5.8.0 certbot snap install and it seems to be working correctly now without the error hitting.
certbot certificates -vvv
Root logging level set at 0
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Starting new HTTP connection (1): ocsp.sectigo.com:80
http://ocsp.sectigo.com:80 "POST / HTTP/1.1" 200 279
OCSP response for certificate /etc/letsencrypt/live/[redacted]/cert.pem is signed by the certificate's issuer.
OCSP certificate status for /etc/letsencrypt/live/[redacted]/cert.pem is: OCSPCertStatus.GOOD
Notifying user: Found the following certs:
Certificate Name: [redacted]
Serial Number: [redacted]
Key Type: ECDSA
Identifiers: [redacted]
Expiry Date: 2026-11-22 23:59:59+00:00 (VALID: 47 days)
Certificate Path: /etc/letsencrypt/live/[redacted]/fullchain.pem
Private Key Path: /etc/letsencrypt/live/[redacted]/privkey.pem
Thanks for the update! Glad to hear it's fixed. There's now an open issue to throw in a try:catch just to harden against future errors that we'd accept a well-written PR for. We're now using discussions upvotes to inform prioritization of bug fixes, so if there's still interest in seeing an additional change on our part or if people are still having this issue with Sectigo or other providers, please do throw an upvote on the discussion on the certbot issue and/or comment to let us know.